السيناريو
A security information and event management (SIEM) platform needs a database to store log sources, normalized events, correlation rules, alerts, incidents, and associated assets and users.
ما الذي يتضمنه هذا الرسم
اقرأ القرارات الكامنة وراءه.
01
Normalizing events with foreign keys to log sources, assets, and users
02
Using junction tables for many-to-many relationships between alerts and events, and incidents and alerts
For any SIEM or log management system that correlates events into alerts and incidents.