Yeah, good point. When you have millions of logs per day you have to pick what you look. Start by some categories of logs that could be interesting (logins, logins from odd locations, errors, and drill down to see what you can find). As far as alerts they are the beginning of your investigation, not the end goal. Use them as the entry point to investigate. Some ideas here too:
Yeah, good point. When you have millions of logs per day you have to pick what you look. Start by some categories of logs that could be interesting (logins, logins from odd locations, errors, and drill down to see what you can find). As far as alerts they are the beginning of your investigation, not the end goal. Use them as the entry point to investigate. Some ideas here too:
https://trunc.org/learning/threat-hunting-using-your-logs…