상황
A security information and event management (SIEM) platform needs a database to store log sources, normalized events, correlation rules, alerts, incidents, and associated assets and users.
이 도면에 담긴 내용
그 이면의 의사결정을 읽어 보세요.
01
Normalizing events with foreign keys to log sources, assets, and users
02
Using junction tables for many-to-many relationships between alerts and events, and incidents and alerts
For any SIEM or log management system that correlates events into alerts and incidents.