How is event data used to identify suspicious, anomalous, and malicious behavior?

Alert Logic® Log Management offers two methods to identify suspicious, anomalous, and malicious behavior. The first is through our managed security services. Our teams review security and compliance-based logs and compare the activity against a pre-defined baseline of acceptable activity. If anything is seen outside of the acceptable baseline, the customer will be notified. In addition to the managed service analysis and escalation, the user can leverage correlation rules that specifically assist in identifying malicious activity. While correlation rules are specifically defined by the user, Alert Logic provides support guidance to assist in the creation of these rules.