In Chapter 6, Network Security Data Analysis, we looked at how individual systems might flag an occurrence as suspicious. Sometimes, however, each individual occurrence is not suspicious on its own. A good example of this is in identifying scams online. The first time you are told you are a winner of $1 million and to click through to tell them which account to pay the money into, this might not seem suspicious – particularly if you were already on a competition site! But when your friend also wins $1 million, and her friend and several other people you know, that would certainly seem suspicious!
When identifying a scam – and when identifying a security alert – having data from multiple sources is often advantageous. Having aggregated the data from multiple sources such as NetFlow, Antivirus, IPS/IDS, and...