Using Machine Learning to Reduce the Alert Fatigue
30Most enterprises today have a number of security tools to support their security operations. In many cases, these tools have a view of what they think are bad and thus produce a large number of alerts. The problem is, the majority of these alerts tend to be false positives rather than true positives. Using machine learning, we can identify those alerts which are more likely to be true positives, thus expending more energy towards these alerts. In this session, we will discuss how you can leverage the SOAR, the SIEM (or any other security tool), Threat Intelligence and case management platforms, to build a machine learning model to aid with reducing the alert fatigue.
Nik Alleyne is a SANS Certified Instructor with over 20 years in IT, with the last 10 years being more focused in cybersecurity. He is currently the Director of Business Development for a Managed Security Services Provider (MSSP), where he is responsible for leading multiple teams supporting various security technologies including IDS/IPS, Anti-Malware tools, proxies, firewalls, SIEM, Cloud, and WAF. Nik teaches both SEC503: Intrusion Detection In-Depth and SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling for SANS and is a published author of two books Hack and Detect and Mastering TShark Network Forensics.