I'm trying to make SOC Use cases clear, concise, and easy to find later. It is possible to make a threat detection use case based on MITRE, but I guess SOC is not the only threat detection. There are many other requirements such as compliance and business use cases. What approach should be more effective and right? Here are my questions. Use Case Development: - Best practices for effective SOC use cases and recommended frameworks? Documentation and Knowledge Management: - Strategies/tools for organizing SOC use cases for searchability? Continuous Improvement: - Methods for improving and updating SOC use cases over time? - Can you share examples of how penetration testing results have influenced the development of SOC use cases? Risk Assessment Integration: - How do you align SOC use cases with risk levels identified in risk assessments? - Are there specific metrics or indicators from risk assessments that should be incorporated into SOC use cases? - What best practices do you suggest for regularly reviewing and updating SOC use cases based on changes in risk assessments? ... View more

    We are running Splunk ES and trying to make log search and app interfaces for each company. Let's call them CompanyA, CompanyB and CompanyC.Each company has to see its own data and also notable events in ES. As a holding company, we need to access and see all data. What is best way to achieve this goal? Please advise. ... View more

Currently, our company successfully collects most of the Microsoft 365 logs, but we are facing challenges with gathering the security logs. We aim to comprehensively collect all security logs for Microsoft 365, encompassing elements such as Intune, Defender, and more. Could you please provide advice on how to effectively obtain all the security logs for Microsoft 365? ... View more