Security Analytics

Security Analytics is the data-based evaluation of security-relevant information in IT security for detecting anomalies, threats and patterns. At its core, it is about efficiently transforming large volumes of telemetry, log data and context into usable insights. Depending on the platform, rules, statistical methods, machine learning or behavioral analyses are used for this. Security analytics is particularly important where classic individual signals are not sufficient to reliably detect complex attacks.

The approach improves the prioritization of incidents and provides analysts with a better basis for decisions. False positives can also often be reduced through more context-rich analyses. For modern SOCs, security analytics is therefore not an additional function, but a central foundation. Ultimately, the term stands for translating data into operational security results. Operationally, automated attack detection helps to separate relevant signals from less critical events more quickly.

See also: Next-Gen SIEM, Security Operations Center and Extended Detection and Response.