Operationalizing machine learning for SIEM

Mike Paquette

Sr. Director Product Management, Security

Elastic

Neil Desai

Security Specialist

Elastic

Unsupervised machine learning (ML) is a core capability for most security operations teams looking to implement an advanced threat detection or insider threat program. However, the deployment of ML can present adoption challenges for security teams. Unless they have in-house data scientists to develop and tune threat models and skilled threat hunters to investigate alerts and manually follow up on interpreting anomalous behaviors, teams may find themselves struggling to gain useful insights and operational value out of ML tools.

See how a “fully operationalized” approach to ML can set your team up for success. You will learn the following, as presented and demonstrated in the context of real-world examples and scenarios:

• How integrated ML can help you develop a high-efficacy, unified detection strategy
• Which categories of threats ML can help you uncover
• Considerations for when to apply specific ML techniques
• Why a data-agnostic approach to ML is critical for scaling SIEM use cases

Related Resources:

• Blog: Train, evaluate, monitor, infer: End-to-end machine learning in Elastic
• Docs: Anomaly detection with Machine Learning
• Webinar: Machine learning in security
• Want to try it for yourself? Learn more about Elastic Cloud or, if you're ready to get started, spin up a free 14-day trial