
You bought a static rule-based correlation and you want to get the most out of it, or are you planning on getting and deploying one? There are some simple steps you can take to maximize its efficiency.
The main use case for correlation is real-time incident management, so you need a 24x7x365 team of forensics experts to validate and follow-up on alerts - in real time.
No need to have real-time correlation if you only have a 9-5 operation...
If an alarm goes on at 3.a.m., do you have the skilled staff to act on it? If the answer is no, can you afford such a team? If you can't afford a 24x7 staff of experts, ask yourself if correlation is really the most appropriate effort for you.read more