Correlation with ESM

Question 1

What is correlation?

Answer 1

Is the process to turn logs into meaningfull data. ERC and ACE supports correlations but ERC only support rule-based correlation while ACE supports rule-based, risk-based, and correlation with flows (ACE also can be run in real-time or historical mode).

Question 2

What is Normalization?

Answer 2

Is the act of changing different types of logs into a single format which enables event correlation to occur.

Question 3

How does it work a correlation engine on an ERC?

Answer 3

• Analyzes data flowing from an ESM
• Detect suspicious patterns within this data
• Create correlation alerts
• Alerts then are inserted into ERC alerts database

Question 4

What are the two types of correlation engines that an ACE has?

Answer 4

• Risk correlation: A risk detection engine that generates a risk score using ruleless correlation.
• Rule correlation: A threat detection engine that detects threats using a traditional rule-based event correlation.

Question 5

What dedicated appliance can be deployed alongside the ESM to provide correlation logic that supplements the existing event correlation capabilities?

Answer 5

ACE