Speaker: Dominik Münsterer

Security teams face the same challenge every day: thousands of alerts from SIEM, EDR, firewalls and cloud services, too few analysts, and little time for the cases that really matter. The result: alert thresholds get raised, and supposedly low-severity events are archived unseen. Yet that is exactly where the hard-to-detect attacks often hide: quiet reconnaissance, misused accounts, slow data exfiltration.

This talk shows how a single raw alert becomes an enriched, well-documented case, and how AI resolves this dilemma.

Lower the threshold instead of ignoring alerts:
AI can analyze low-severity alerts that an analyst would never have time for, using context from Active Directory, logs and more: gathering context, ch ...