Skip to content
Threat Feed
Subscribe

Tag

Esql

1 brief RSS
high advisory

Detection of Potential Lateral Movement via Alert Correlation

This detection capability monitors for lateral movement by identifying sequences where a host IP address from one security alert subsequently appears as the source IP in alerts from a different host.

lateral-movement threat-detection esql detection-engineering
1t