Security Analyst Diaries - EP2: Context-Aware Detections

With context-aware detections in Google Chronicle, Google’s cloud-native SIEM, all the supporting information from authoritative sources (e.g. CMDB, IAM, and DLP) including telemetry, context, relationships, and vulnerabilities are available out of the box in one rule. Google Chronicle customers can now incorporate context earlier in the detection authoring and execution workflow, enabling them to: - Enhance fidelity of alerting: Enabling analysts and detection engineers to filter out entire clusters of threats that may be expected or represent little-to-no danger to the enterprise. - Prioritize threats with risk scoring: Making relevant context available for heuristic-driven contextual risk scoring of detections at detection execution time rather than at the human triage stage. - Respond to alerts faster: Enables them to respond to alerts faster by giving them a graphically integrated and interactive way to view context information from inside the alerts page. In this diary entry, we’ll recap the basics of Chronicle’s context enrichment, drill into the new capabilities this release provides, and cover some examples of how Chronicle users have been using these capabilities so far. You can also learn more by reading the blog here: https://chroniclesec.medium.com/security-analyst-diaries-2-detect-alert-respond-context-is-key-everywhere-in-security-operations-1f7b9be0f7c3