Research SOC update Public documentOpen access
An MSc project at ESH built an AI assistant that adds knowledge from past investigations and threat reports to the alert an analyst is working on. Eight of our analysts tested it on a realistic malware case.
Zuhayr A. Mirza and Luca Allodi · 5 min read · PDF
Research SOC update Published paper
The ESH-SOC is integrating behaviour profiles into its monitoring of sign-ins to Microsoft’s cloud. The method comes from a study by TU/e and the SOC, tested on five months of sign-in logs from one of the SOC’s customers, a Dutch IT service provider, and checked by two of its senior IT managers.
Gelareh Hasel Mehri, Emmanuele Zambon and Nicola Zannone · 7 min read · DOI
Research SOC update Published paperOpen access
Every analyst at the ESH-SOC investigates alerts along the same four stages, and every new tier 1 analyst learns them in training. The structure comes from a study by TU/e and the SOC, in which analysts who followed it recognised alerts caused by attacks far more often.
Leon Kersten, Tom Mulders, Emmanuele Zambon, Chris Snijders and Luca Allodi · 6 min read · PDF