The SOC needs a fast count of failed logons for the treasurer account across last week. Which SIEM search approach is the best practice in Enterprise Security?
Select an answer to reveal the explanation.
Short Explanation
Counting failed treasurer logons with index-star and the word password is searching the landfill with a rake. tstats on an accelerated Authentication model is the SIEM loading dock. Spreadsheets and leading wildcards are how searches miss their shift.
Full Explanation
SIEM best practice in Enterprise Security is to query accelerated data-model summaries with tstats rather than raw index= scans. Failed logons are Authentication-model events; an accelerated model makes week-long counts cheap and consistent. index= password, unbounded transaction, and CSV exports are inefficient and miss CIM normalization. Prefer constrained, accelerated data-model searches for ES-scale questions.