Data sources of interest
There are obviously many different data sources that could be interesting to integrate, and they depend on each organization's activity, specific use cases, and risk appetite. A key point to mention is that throughout our experience, we have often seen that companies spent months (even years) adding each and every data source within their SIEM. To caricature the approach, let's collect everything and we'll see what we do with the data later. More specifically, companies usually tend to focus on bias risk analysis, which identifies the most critical assets, that is to say, the crown jewels, in order to create detection rules. It often ends up with complex integration and low-value detection use cases. Of course, it might work with the necessary resources (staff, budget, and time) but might still not focus on what real threats would be doing. Indeed, risk assessment very often doesn't leverage cyber threat intelligence (CTI) inputs as it should...