TOPIC
Tooling
SIEM, EDR, and the rest of the acronym soup: what the tools do, what they cost you in attention, and when you genuinely need them.
Articles
Nothing filed here yet. It's on the list.
Key terms
Endpoint Detection and Response: an agent that records endpoint activity, detects suspicious behavior, and lets responders isolate or remediate machines remotely.
Security Information and Event Management: a platform that collects and correlates logs across systems so analysts can detect and investigate incidents.