Why My SIEM Missed an Intrusion on a Misconfigured Switch: Revision history

From Wiki Spirit
Jump to navigationJump to search

Diff selection: Mark the radio buttons of the revisions to compare and hit enter or the button at the bottom.
Legend: (cur) = difference with latest revision, (prev) = difference with preceding revision, m = minor edit.

15 October 2026

  • curprev 18:1818:18, 15 October 2026‎ Megan-myers77 talk contribs‎ 14,017 bytes +14,017‎ Created page with "<html><p> The alert arrived after the damage was done. An endpoint detection platform had flagged unusual activity on a workstation, and the investigation found that an attacker had moved across parts of the network that should have been separated. We went looking in the SIEM for a clear trail: connections, device events, perhaps an obvious policy breach. There was no useful story there.</p> <p> That did not mean the SIEM was broken. It meant the network was not giving i..."
Retrieved from "https://wiki-spirit.win/index.php/Why_My_SIEM_Missed_an_Intrusion_on_a_Misconfigured_Switch"