Utilization of Artificial Intelligence to Enrich Threat Detection Marketplaces for Small and Medium Enterprises

Traditional Security Operation Centers (SOC) depend on multiple sources of security events to correlate alerts and identify malicious activity that represents an emerging threat against the organization.These sources may generate gigabytes or terabytes of data, which makes it difficult to analyze and identify true positive malicious activity, as it consumes a lot of resources for most organizations.With this large amount of data to analyze, plus the growing volume of malicious actors that intend to affect critical operations, organizations require better responsiveness to address threats and improve the company's cybersecurity posture by reducing the risk.While modern security solutions leverage Artificial Intelligence to improve analysis and correlation of events, those solutions are cost-prohibitive for Small and Medium Enterprises (SME).The introduction of Threat Detection Marketplaces (TDM) helps SOC teams with faster detection of threats by leveraging the collective security industry expertise to empower smart data orchestration and cost-efficient threat hunting.While TDM gives organizations tested Sigma rules from industry experts, Artificial Intelligence can improve the TDM content and offerings in many ways, such as Sigma rules optimization and validation, rules correlation with MITRE tactics for maturity assessments, and new rules based on unusual patterns or behaviors.