One approach to prevent malware exploits is for an administrator to continuously monitor the network and analyze the log files generated by network devices. Security operations center (SOC) tools, such as security information and event management (SIEM) and security orchestration, automation, and response (SOAR) systems automate the log file gathering and analysis process. It has become an accepted fact that malware will enter the network despite the best defenses. For this reason, a multilayered approach to malware protection must be employed. Logfiles generated by devices at each layer will help to identify whether an exploit has occurred, the diagnostic features of the exploit, and the extent of the damage within the enterprise. The information gathered in logfiles will also help to inform measures taken in response to the exploit, such as containment and mitigation
-
The IDS device is physically positioned in the network so that traffic must be mirrored in order to reach it.
-
-
