As the scale and volume of network logs, incidents, and threats grow exponentially, it has become inevitable for SOC teams to deal with the following pain points: manual handling of analysis, configuration, and periodical revisions for multiple threat cases, and false alerts that require sifting through 1,000s of notifications from security tools to find one or two critical alerts.As we transition to more advanced and automated threat detection systems to resolve these concerns, ManageEngine Log360 has stepped into the world of a true next-gen SIEM by introducing the industry's first adaptive threshold capability for real-time alerting.
The Smart Threshold functionality is a part of Log360’s Vigil IQ, the threat detection, investigation, and response (TDIR) module of Log360, which works with the real-time event response console, and user entity behavior analytics (UEBA). Utilizes the exponential moving average (EMA) algorithm to automatically analyze and fix a baseline count for events and anomalies occurring within a specific timeframe. Updates the baseline threshold periodically for every 15 data sets.
Log360 collects, parses, and analyzes logs from 750+ log sources, providing real-time records of all the events occurring in your network. Detecting anomalous events and patterns with alerting modules. The SIEM alerting module uses 100s of prebuilt criteria specific to different log sources to detect malicious activities from the recorded events. The UEBA capability uses ML-based behavior analytics and pattern detection to trigger anomaly alerts. Precision tuning to filter true alert cases with adaptive threshold. The alert generation is further fine-tuned using the adaptive threshold functionality to precisely notify you when there is a deviation from the usual occurrence of events or anomalies. Add log sources and criteria, compare manual vs smart threshold, follow the remediation workflow, and manage alerts in a central dashboard.
Setting thresholds for specific timeframes, based on the log sources and alert criteria, is one of the advanced configurations offered in SIEM solutions to reduce alert noise. Log360's adaptive threshold feature automates this functionality and aids SOC teams in enabling multiple alert profiles required for their environment, without the hassles of manual configuration.
While the UEBA module accurately finds anomalies, precise threat detection is also needed to avoid working on low priority, non-threat events, or false positives. The Smart Threshold layer along with the UEBA module will contextually enrich the anomaly feeds and precisely identifies real threats. While the first layer of the prebuilt anomaly detection in UEBA finds deviations from established patterns and prioritizes them based on risk score, the second layer creates a baseline threshold for the frequency of deviations to spot anomalies that are real threats.
With Log360's Smart Threshold, there's constant learning and fine-tuning of the threat detection process. The dynamic ML model of EMArevises the threshold baseline for every 15 data sets based on the changes in the network such as:
Count-based anomaly detection is configured for commonly occurring network events to help capture important indicators of compromise early on, before threat patterns of ransomware attacks, and advanced persistent threats fully develop. The table below provides examples of some count-based anomalies that can be early indicators of known attacks.
Log360's adaptive threshold helps find significant spikes in these events without a constant trigger of false alarms. The early detection IoCs also facilitates immediate response and remediation of threats, gradually reducing the mean time to discover (MTTD) and mean time to respond (MTTR).
Build alert profiles with ease using Log360’s real-time alerts dashboard, which supports a wide range of log sources, including network devices, applications, and vulnerability scanners. Choose from over 500 prebuilt criteria for different use cases, configure alerts with automated adaptive thresholds, and monitor all alerts from a single console. Filter alerts by severity, create tickets, and activate integrated workflows to streamline alert management.
Log360 also ingests STIX/TAXII and Alienvalult OTX threat feeds for contextual threat detection along with offering rule-based pattern detection with real-time event correlation and implementation of threat modelling framework MITRE ATT&CK.
Level up your TDIR game by deploying a comprehensive SIEM solution like Log360 with UEBA, CASB and integrated DLP capabilities that brings all your security needs into single console, and helps you precisely detect threats with automated features like adaptive alert threshold.
We wanted to make sure that one, we can check the box for different security features that our clients are looking for us to have, and two, we improve our security so that we can harden our security footprint.
Carter Ledyard
The drill-down options and visual dashboards make threat investigation much faster and easier. It’s a truly user-friendly solution.
Sundaram Business Services
Log360 helped detect insider threats, unusual login patterns, privilege escalations, and potential data exfiltration attempts in real time.
CIO, Northtown Automotive Companies
Before Log360, we were missing a centralized view of our entire infrastructure. Now, we can quickly detect potential threats and respond before they escalate.Log360 has been invaluable for improving our incident response and ensuring compliance with audit standards. It’s a game-changer for our team.
ECSO 911
In the context of SIEM solutions, adaptive threshold is a mechanism that dynamically analyzes the occurrence of events in the monitored network to create a baseline that differentiates normal behavior and true anomaly cases. Adaptive threshold dynamically adjusts to the changing environments and uses statistical ML models to achieve this.
Threat detection modules discover malicious patterns in a network, find abnormal spikes in flow of events, and use rule-based and signature-based methods to detect threats. Sequencing multiple methods of anomaly detection produces a layered threat detection system.
In Log360, count-based filtering using adaptive threshold is layered on top of behavioral-based anomaly detection. Here's an example to understand how it proves effective with precise threat detection:
Layer 1 behavioral pattern - Generate anomaly if important work files are accessed during non-working hours.
Context: Consider an enterprise environment with 1000s of employees. Employee A is a malicious insider, who is about to leave the company. He/she has been suddenly accessing multiple files during non-working hours. The above mentioned pattern will generate alerts for this behavior. But the issue is, this true alert will be buried in 100s of similar false alerts. There can be multiple genuine reasons for user behavior deviations in an enterprise with huge number of employees.
Layer 2: Smart Threshold - if a particular user account generates multiple anomalies within a specific timeframe that deviates from the usual count, generate alert.
A layer 2 of filtering with count based adaptive threshold, will cut down the alert noise for the 100 other users who usually have a few anomalies normal to their behaviour. But it will single out employee A's activities by generating alert, since it crosses the threshold.
Automatically adjust alert thresholds based on changing network activity to identify threats and reduce false alerts. Minimize manual configuration, improve detection accuracy, and help your SOC team focus on critical security events.
