Team,
One of action items that I came out of the Requirements meeting last week (See
meeting minutes here: http://tinyurl.com/oehgnep), was to collaborate on a list
of questions for a survey that we can send out to customers/SOC teams.
This thread is to colloborate on a list of questions that we want on this
survey. The goal is by the middle of next week is take everyone's feedback and
to formalize into a survey that we can start to send out to various users,
customers and SOC teams.
Please add relevant questions so we can start to create prioritized list of
requirements.
Here is my starting list of questions:
----
1. What security devices are important to stream into Metron Security Data Lake
Platform? Supporting a device on the Metron platform means providing:
a. agent to collect data from the source
b. parser to parse the device data format into a normalized dataset
2. What type of enrichment would you like to do to the security telemetry data?
3. What are the different source of threat intel feeds you get? Which vendor do
you get the feed from and what is the format. Supporting an out of the box
threat intel feed means the following:
a. Supporting parsers for the intel feed to persist the feed store in
normalized form
----
--
George Vetticaden
Principal, COE
[email protected]<mailto:[email protected]>
(630) 909-9138
