The modern Security Operations Center (SOC) is a highly complex system of point tools, all designed to keep sensitive corporate data secure. Each of these tools creates disparate data points and incidents. Security analysts investigate the barrage of incidents and alerts, looking for clues while asking themselves: is this alert stemming from an actual event? What is the source of this alert? Has this been through our system before?

Out of context, these cyber security events are all just data points living in their own silos. The signs are easily misinterpreted, potentially leading to security disasters. But when viewed in context, these individual clues can tell a lot about the organization’s security. With context, analysts can understand relationships, see the entire story, and keep their organizations secure.

Read more - https://www.siemplify.co/blog/cyber-ontology-glue-driving-security-operations-orchestration-incident-response/