SIEM use cases (detection rules)
A SIEM (security information and event management) use case is a defined threat scenario the system must detect, along with the log sources, the correlation rule and the expected response. For example, alerting when an account racks up several failed sign-ins and then logs in from another country. Without defined use cases, a SIEM collects logs but produces few useful alerts.
How TecnetOne handles it: TecnetSOC
SIEM detection rules, correlation rules, SIEM use case examples, detection engineering, SIEM alerts
Related terms
Vulnerability prioritization (KEV and EPSS)
Vulnerability prioritization is the process of deciding which flaws to fix first based on real risk, not severity alone. Beyond the CVSS (Common Vulnerability Scoring System) score, it weighs the CISA KEV (Known Exploited Vulnerabilities) catalog and EPSS (Exploit Prediction Scoring System), which estimates the probability that a vulnerability will be exploited in the next 30 days.
Anomaly detection
Anomaly detection is a technique that identifies activity deviating from a learned baseline of normal behavior, such as traffic spikes, sign-ins at unusual hours or atypical download volumes. Unlike UEBA (user and entity behavior analytics), which focuses on accounts and devices, it applies to any data source: network traffic, logs or transactions. For example, it flags a server sending ten times its usual data overnight.
Virtual patching
Virtual patching is a security rule that blocks attempts to exploit a known vulnerability at the network level, in a firewall, an IPS (intrusion prevention system) or a WAF (web application firewall), without modifying the affected software. It provides protection until the vendor patch is applied or on systems that cannot be updated, such as end-of-life equipment, but it does not replace the patch.
Compromise assessment
A compromise assessment is a review that looks for evidence that an attacker is or was inside an organization's network, even if no incident has been detected. It analyzes endpoints, accounts, logs and traffic for indicators of compromise; it is useful, for example, for a company without a SOC (security operations center) before an acquisition or after an isolated alert.
Rules of engagement (pentest)
Rules of engagement are the document that defines, before a penetration test, which systems may be attacked, with which techniques, during which hours and whom to contact if a problem arises. For example, they may exclude social engineering or prohibit denial-of-service testing during business hours; they protect the company and give the testing team legal authorization.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.