Now that we have configured several sources of data, log, and information collection from the ICS network systems, they start to populate the SIEM databases. The SIEM will use algorithms, correlation rules, and other kinds of logic to make conclusions on the (malicious) activity going on in the monitored network.
Some basic drilldown functionality can be observed from the dashboard page, where several widgets portray the current security posture for the monitored network:
If, for example, we are interested in finding out more about the Exploit category of the SIEM: TOP 10 EVENT CATEGORIES widget, a simple click on the word ...
