Skip to content

Security Operations Centers Working Group documentation

Anomaly detection and Alarming

Security Operations Centers Working Group documentation

Introduction
What is a SOC?
Should I deploy a SOC?
Reference design
Threat Intelligence
Threat Intelligence
- MISP
  MISP
Data sources
Data sources
- Zeek
  Zeek
Messaging, Transport and Enrichment
Messaging, Transport and Enrichment
- Introduction
Enrichment Sources
Enrichment Sources
- Introduction
Storage
Storage
- Elasticsearch
  Elasticsearch
Visualisation
Visualisation
- Introduction
Alerting + Incident Response
Alerting + Incident Response
- Introduction
Other topics and materials
Other topics and materials
- Integrations
  Integrations
  - Introduction
  - MISP to Zeek
- Networking
  Networking
  - Introduction
  - Network layout and mirroring at CERN
- Glossary
- Resources

Anomaly detection and Alarming

This chapter is meant to give you some hints on how you can implement anomaly detection and alarming on the client side.