SIEMvolution. Artificial Intelligence enhancements for Building more Efficient Managed Cyber Security
摘要
The world is witnessing an accelerating pace in the constant competition between threats and protection. New vulnerabilities, attack methods, and malicious actors emerge every minute, creating an urgent need for continuous testing, assessment, and countermeasures. This need has led to the development of numerous tools and methods to combat threats and improve the protection of digital borders and assets. Information is the lifeblood of any business or organization. It determines how companies develop strategies and implement processes. To access to large amounts of information comes great responsibility. In recent years, a collection of tools known as Security Information and Event Management (SIEM) systems has emerged, becoming the de facto standard for company protection in the digital world. Companies have been promised that SIEM systems could act as a comprehensive alarm system by collecting enough logs and performing minimal configuration, they would trigger alarms as soon as an attacker attempted to tamper with the data. This paper explores the integration of AI into SIEM systems to improve efficiency and effectiveness. The proliferation of sophisticated cyber threats necessitates advanced security measures. The study explores how AI can complement SIEM systems, focusing on three key improvements: threat detection, fewer false positives, and optimization in incident response.