Cybersecurity Architecture: Detection

Key cybersecurity concepts (Detection focus)

The video frames overall security using the formula:

S = P + D + R Prevention (P) + Detection (D) + Response (R) = overall security

It also ties this to the CIA triad:

• Confidentiality
• Integrity
• Availability

The series previously covered security “domains” (IAM, endpoint, network, application, and data security) as mostly prevention-focused, and the current segment emphasizes D (Detection).

---

Detection workflow and the SOC role

Detection is described as a pipeline that:

1. Collects information from multiple security domains
2. Monitors
3. Analyzes
4. Reports
5. Supports threat hunting

These activities are largely handled by the SOC (Security Operations Center).

---

SIEM (Security Information and Event Management) — main ideas

Purpose: why SIEM exists

In many environments, teams use separate consoles per domain (identity, endpoint, network, etc.). This creates:

• No consistent single view
• Inefficiency when one attacker triggers many alerts across multiple systems

What a SIEM does

SIEM acts as a central layer on top of domain tools by building a database that gathers:

• Logs
• Events/alarms
• Network flow data

It then performs correlation to transform many related alerts into a single, more manageable incident view.

SIEM supports analysis using rules/policies, including:

• Complex rule conditions (e.g., geo-based traffic combined with repeated failed login behavior)
• Built-in detections (“out of the box”) plus custom rules

SIEM also enables actions and triage:

• Generates alarms with priority levels (high/medium/low)
• Assigns alarms to analysts
• Can prioritize using confidence calculations

Finally, SIEM looks for anomalies using:

• AI / machine learning
• Specifically references User Behavior Analytics (UBA)

Examples of anomaly framing include:

• A user behaving unlike their peers
• Activity happening at unexpected times

SIEM provides trend reporting for management and SOC KPIs, such as:

• Are you detecting more or fewer alarms month over month?
• Are incidents being resolved faster?

---

XDR (Extended Detection and Response) — main ideas

Positioning vs SIEM

The video emphasizes this is not simply SIEM vs XDR, but rather:

• XDR plus SIEM

How XDR differs

SIEM origins largely come from two camps:

• Log management vendors (centralizing logs)
• Network management vendors (network anomaly/behavior monitoring)

XDR origins are built upon EDR (Endpoint Detection and Response), with a more “top-down/bottom-up” contrast:

• EDR installs agents on endpoints to detect/respond close to the source
• XDR aggregates and coordinates endpoint detection more broadly

Federated Search feature

Some XDR platforms add Federated Search, which:

• Queries multiple systems on demand
• Avoids pre-storing all data in a massive centralized database
• Lets each system search its local database and return only matching results

Goal: more efficient “just-in-time” data retrieval.

Relationship with SIEM

A common pattern suggested is:

• SIEM alarms trigger investigation
• XDR performs targeted, just-in-time searches to reduce noise and cost

---

Threat hunting — analysis and timing argument

Why it matters

The video describes attacker behavior:

• Attackers begin with reconnaissance to find weaknesses

It references Ponemon Institute’s Cost of a Data Breach timing concepts:

• Mean Time to Identify (MTTI): ~200 days
• Mean Time to Contain (MTTC): ~70 days
• Total: ~270 days until recovery (about a year)

What threat hunting changes

Threat hunting is described as proactive, unlike standard investigation which is reactive to alerts.

A threat hunter:

• Uses analyst experience/instincts to form a hypothesis about attacker actions
• May not have an alert yet
• Uses SIEM/XDR tools to search for indicators of compromise (IOCs)

Outcome: earlier detection—bringing awareness closer to the actual attack timeline—even if prevention isn’t perfect.

---

Main sources / speakers

• Speaker: Not explicitly named in the subtitles (presenter/teacher covering SIEM, XDR, and threat hunting)
• External referenced source: Ponemon Institute (for MTTI/MTTC timing figures)