ConceptsFirst-Seen Detection
First-Seen Detection
A SIEM detection technique that flags activity occurring for the first time in an environment, a new domain, a never-before-seen process, a first login from a location, since novelty often signals something worth investigating.
6 direct links5 lessons
Concept Neighborhood
Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons
Start here
Baseline Analysis
The foundation First-Seen Detection builds on, worth understanding first.
Prerequisitelearn this first
Relatedsorted by lesson coverage
Related Lessons
5 lessons cover this conceptSIEM Data Models and Log Normalization
SOC Analyst
Aggregation and Statistical Analysis for Threat Detection
SOC Analyst
Time-Series Analysis and Multi-Source Correlation
SOC Analyst
Query Tuning, Lookup Tables, and Production Operations
SOC Analyst
Designing a Detection Program with SIEM Queries
SOC Analyst
Sign in to open lesson content directly.