Neil Desai

Trying to do proper monitoring is more than just turning on the logs and let the SIEM sort it out. Unfortunately that is what many companies do and then wonder why they fail and make the headlines. There is a gap between installing a point product (IDS/IPS, AV, firewall, etc.) and properly monitoring the events from that solution. I have seen many companies making the same mistakes: turning on the firehose of events and then thinking the are good to go. This talk will go over the missing element in a creating a good monitoring solution.