Skip to main content
Version: Next

Threat Detection

Goal​

Detect known and unknown threats across all network layers, and give the security team the context needed to respond quickly.

How SentriaOne xSIEM supports it​

CapabilityContribution
Signature-based detectionIdentifies known attacks, for example traffic matching an intrusion detection rule
ML and behavioural analyticsIdentifies unknown or unusual activity, such as anomalous connections or data transfers
MITRE ATT&CK mappingPlaces each detection in the context of attacker tactics and techniques
Incident ResponseTracks each detection from review to closure, with recommended mitigations

Detections are grouped into categories such as C2, UEBA, Caution, Exfiltration, and Discovery.

Typical workflow​

  1. Review new and high-risk detections on the Security Overview.
  2. Work through detections in Detections › Triage, highest risk first.
  3. Open each detection and verify what happened using its records, risk signals, and participant history. See Detection Details.
  4. Decide on an action using the MITRE ATT&CK mitigations, and record the outcome in Detection Tracking.
  5. Use Detections › MITRE Map to see which attack stages are observed over time.

Example scenarios​

ScenarioWhere it appears
Exploitation attempt against a web serverSignature detection in the Caution category, with HTTP records as evidence
Internal host beaconing to an external serverC2 detection with regular connections to the same peer
Large or chunked uploads to cloud storageExfiltration detection with bytes-sent evidence
Internal host scanning many portsDiscovery detection