{"id":33913,"date":"2023-11-16T10:25:52","date_gmt":"2023-11-16T18:25:52","guid":{"rendered":"https:\/\/insidebigdata.com\/?p=33913"},"modified":"2023-11-16T10:25:55","modified_gmt":"2023-11-16T18:25:55","slug":"starting-your-advanced-analytics-journey-three-areas-to-focus-on","status":"publish","type":"post","link":"https:\/\/insidebigdata.com\/2023\/11\/16\/starting-your-advanced-analytics-journey-three-areas-to-focus-on\/","title":{"rendered":"Starting Your Advanced Analytics Journey: Three Areas to Focus On"},"content":{"rendered":"\n

In large organizations today, the amount of data that needs to be sifted through continues to grow in volume. Consider this stunning prediction from John Rydning, the research vice president of IDC’s Global DataSphere: the global datasphere is expected to more than double between 2022 and 2026. Not only is there a massive amount of information, but there aren\u2019t enough people to properly analyze all of it.<\/p>\n\n\n\n

Within the security function alone, there is a massive amount of data, with different tools all generating information. But when you apply advanced analytics in a meaningful way, you can drive valuable insights, cut through the noise and, ultimately, increase efficiency. It’s helpful to start small and then build up toward more advanced use cases.<\/p>\n\n\n\n

Below are recommendations for three areas to consider when it comes to your advanced analytics initiative, along with four best practices.<\/p>\n\n\n\n

Understanding every asset on your infrastructure<\/strong><\/p>\n\n\n\n

Every organization struggles with understanding what is in their tech stack while trying to prevent shadow IT from going rogue and creating security risks. Data can help you see the gaps as it helps reveal connections from one point to another. Relying on manual efforts can result in human error, and a lack of real-time asset management can delay response or inhibit effective workflows.<\/p>\n\n\n\n

Since data is entropic and cloud-based services can be ephemeral, the lack of real-time insights into the relationships of your assets and configurations can delay response or inhibit security workflows and the IT service delivery process.<\/p>\n\n\n\n

Don\u2019t underestimate the value of \u201csimple\u201d queries<\/strong><\/p>\n\n\n\n

Security information and event management (SIEMs) tools can be computationally expensive and intensive; security analysts want to \u201csave\u201d advanced analytics for SIEMs to perform, but that undercuts the value of what you might think of as \u201csimple\u201d queries.<\/p>\n\n\n\n

Simple queries enhance advanced analytics. Basic queries, such as \u201chow many failed login attempts have there been in the past hour,\u201d can help to paint a more complete picture of what\u2019s really happening in your environment when combined with the results of more advanced queries. An example would be a search for specific CVEs to discover vulnerabilities in the organization. The net result of these connected queries is a better and more complete response to the question you\u2019re trying to answer.<\/p>\n\n\n\n

Using advanced analytics to reduce the noise<\/strong><\/p>\n\n\n\n

Today\u2019s organizations are grappling with thousands of alerts. While precise numbers vary, it\u2019s widely estimated that the average security operations center (SOC) receives around 10,000 alerts a day. Yet as the number of alerts continues to grow, the number of people you have in the SOC who can address those alerts isn\u2019t scaling. Traditional approaches to handling these alerts won\u2019t suffice today.<\/p>\n\n\n\n

Advanced analytics can play a key role in helping drive down the number of threats that your human analysts have to work with. They can be used, for example, to help sort out the false positives so that the alerts fed to human analysts are only those that are deemed credible.<\/p>\n\n\n\n

They can also be used to sort and catalog these alerts in a meaningful way, using:<\/p>\n\n\n\n