Correlation of non-standard sources

[Vladimir Suvorov]

Hello Friends! 

In my daily work, I faced an interesting task, perhaps someone has already encountered a similar one, please share your experience. 

A task: Correlation of events from multiple data sources. The task is complicated by the fact that I do not have information about event codes or descriptions of these events (which I could use to search in the "Content" field in order to subsequently correlate incidents) for several such data sources installed in our company

[Da Beave]

This is extremely difficult if not impossible without understanding the data that you have.   You'll need to have some understanding on what to look for.   Without that,  I don't see how correlation is possible.

--
You received this message because you are subscribed to the Google Groups "sagan-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sagan-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sagan-users/3001d674-9425-4ac7-ab35-32534d277481n%40googlegroups.com.

[Vladimir Suvorov]

Please tell me, how did you manage to create such a wonderful database of pre-set correlation rules in the system?

вторник, 25 мая 2021 г. в 13:11:42 UTC+3, Da Beave:

[Da Beave]

Lots and lots of work from the Quadrant team :) We see a lot of log types at our clients.

To view this discussion on the web visit https://groups.google.com/d/msgid/sagan-users/7242e705-97b0-4a10-a5d6-db1b5fd9077an%40googlegroups.com.