SIEM
Named by 29 kept items in this workspace.
15 items name it under classification.technologies and 14 under tools.
Search every workspace for SIEM. It matches the name as written, so it can find other things that share it.
The items that name it 29
Stores telemetry and correlates findings from AI detection models against other data; does not replace AI threat detection
Security information and event management used by Hugging Face to log initial reconnaissance signals, though it failed to escalate them in time
logs agent approvals, tool calls and agent-to-agent messages with reasoning
Destination for ITDR findings to integrate with SOC incident workflows
Detected the RDP breach at the moment of initial access at the healthcare organization
One of the technology categories required to meet CMMC Level 2's 110 security requirements
Security infrastructure built by security teams to feed and clear the triage queue
Used to retain Security log events (Event 5156) for longer periods than local DC log rollover, enabling correlation
Security monitoring tool; not used by the customer, which obviated earlier detection of threat actor activity
Used to forward ESXi logs and create alerts for suspicious events like new root login, service enablement, VIB acceptance change, and datastore unmounts
visualizing flow logs
central collection and monitoring of Windows Defender event logs (ID 5007) and DNS query logs
Aggregates Strelka scan events; used to write alerting rules on scan.yara.tags fields
All technologies in this workspace.