Enterprise SIEMs are detecting only 21 percent of threat techniques

Enterprise security information and event management (SIEM) tools miss 79 percent of the MITRE ATT&CK techniques used by adversaries, according to a new report. The study from CardinalOps draws on an expansive dataset of 2.5 million total log sources, over 23,000 distinct log sources, more than 13,000 unique detection rules and hundreds of production SIEM environments, and finds that a significant portion of existing detection rules -- 13 percent on average -- are non-functional and will never trigger due to issues such as misconfigured data sources and missing log fields. SIEMs now process an average of 259 log types and… [Continue Reading]