Log aggregation and analysis
As we learned in the previous chapter, logs play an important role in implementing a detective and corrective control strategy. There are millions and millions of events happening in an organization, and without a proper mechanism to aggregate and analyze these logs, the security team could miss many important events, which could lead to an incident. To understand this, let’s consider the example of Google’s Gmail. Imagine the number of people inserting an incorrect password for their Gmail account at any given time. A human could enter an incorrect password maybe five to seven times in a minute. But what if Gmail encountered that the same person was trying out different passwords 100 times per minute or maybe 1,000 times per minute? This would be impossible for a human, and that’s where this would trigger an alert for Google’s Security Operations Center (SOC). Now, as a SOC analyst, you could review one or two of those attempts...