Once the security detection solutions are in place, security monitoring management can be planned to perform security events correlation analysis. The purpose of the security monitoring framework is not to replace existing endpoint or network security solutions, it's to provide the security posture, the security trending, and the security events correlation of the whole environment. Some advanced security monitoring frameworks may even apply machine learning for the security events correlation to identify the abnormalities. Don't just assume that setting up a security monitoring management framework will do everything related to security monitoring. Building a complete security monitoring framework involves incorporating the following key components:
- Log collector: This is responsible for collecting and forwarding all the logs to the security...