Modern security threats are evolving at a faster pace than security technologies, while well-funded threat actors are investing in tools like machine learning (ML), automation, and artificial intelligence (AI). SOCs built around legacy security information and event management (SIEM) weren’t neces- sarily designed for the purpose of accurate detection. As such, they aren’t effective in leveraging ML for detection engineering that keeps pace with digital transformation, cloud initiatives, and advanced attack campaigns.

Challenges from legacy SOC environments can include:
‍
• Lack of visibility and context
• Increased complexity of investigations
• Alert fatigue and noise from a high volume of low-fidelity alerts
• Lack of interoperability of systems
• Lack of automation and orchestration
• Inability to collect, process, and contextualize threat intelligence data
• SOC is often disconnected from the cloud