THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
| Identifier | Question |
|---|---|
| Q1 | What are key challenges and limitations of the current SIEM and security analytics tools that you use today? |
| Q2 | How would you prioritize the challenges today with the existing security tooling you use:
|
| Q3 | In your day to day activities, what types of data sources(logs, pcap, ldap user info, netflow, bro etc..) do you work with the most? |
| Q4 | Are there data sources that your current tools don't support that if did have access to it, it would allow you to do your job more effectively? |
| Q5 | What types of automated and real-time enrichment would you like to see on the raw data that would allow you to do your job more effectively? |
| Q6 | What third party intel feeds do you find most valuable that lead to credible threats? |
| Q7 | What third party intel feeds are you not using that you would like the platform to provide? |
| Q8 | What elements of your data are you not getting the adequate threat intel feeds for? |
| Q9 | Please provide a redacted dump of common correlation rules that you use the most? (e.g: if you see ip from geo-region A with domain that was registered in the last 3 days, then alert), 30 failed logged attempts in the last 30 minutes..). |
| Q10 | What are other actions you would like to perform on the data in real-time (outside of enrichment, cross reference of intel feeds)? |
| Q11 | If the analytics tool only provided a single panel, what will be critical things you want to see? |
| Q12 | What are 3 of the most important KPIs (metrics, Key Performance Indicators) that you would like see on that single panel? |
| Q13 | What deails would you expect an alert to contain? |
| Q14 | Which way of filtering/search for events would be your preferred one?
|
Running List of Questions for the Survey/Questionnaire for
...
CISO Audience
| Identifier | Question |
|---|---|
| Q1 | What specific use cases and cyber security domain problems are you trying to solve with Metron? |
| Q2 | How would you prioritize, in terms of importance, the use cases and challenges below that the SOC is tasked to solve:
Action Items: Group use cases by industry... |
| Q3 | What are key challenges and limitations of the current SIEM and security analytics tools that you use today? |
| Q4 | How would you prioritize the challenges today with the existing security tooling you use:
|
| Q5 | How would you rate your SOC’s data science and analytical capabilities today? |
| Q6 | Does your SOC have any plans to enhance its data science and analytical capabilities now or in the future? |
| Q7 | What data retention capabilities do you require Metron to support? |
| Q8 | What compliance regimes, if any, does your SOC tools and capabilities need to comply with to support the needs of your business? |
| Q9 | What type of enrichment would you like to do to the security telemetry data? (e.g: Geo, Whois) |
| Q10 | What type of enrichment capabilities does your current security tooling NOT provide? Is enrichment of the data in real-time a critical requirement? Is storing the enriched and raw data a critical requirement? |
| Q11 | What are the different threat intel feeds you subscribe to (public, private, tec..)? Which vendor do you get the feed from and what is the format. Supporting an out of the box threat intel feed means the following supporting parsers for the intel feed to persist the feed store in normalized form. |
| Q12 | What are critical requirements for threat intel feed integration with Metron? For example, is cross referencing your threat intel feeds against the original and enriched telemetry data a critical requirement? |
| Q13 | What are the critical functions you would like to perform on the streaming security telemetry data as its coming in real-time in as opposed to after it lands? |
| Q14 | Do you envision Metron replacing your SIEM solution or complimenting it? |
...