Security Data Growth Drives SOAPA (Security Operations and Analytics Platform Architecture)
Happy new year cybersecurity community! Hope you are well rested, it’s bound to be an eventful year ahead.Way back when at the end of November 2016, I posted a blog about an evolutionary trend I see happening around cybersecurity analytics and operations technology. Historically, large enterprises have relied on SIEM products to anchor their SOCs. This will continue but I see SIEM becoming part of a more global cybersecurity software architecture called SOAPA (i.e. security operations and analytics platform architecture). SOAPA uses middleware (i.e. message queueing, transaction processing, etc.), APIs, and industry standards like CybOX, STIX, and TAXII to connect disparate cybersecurity analytics and operations tools and data sources like EDR, network security analytics, UBA/machine learning analytics systems, vulnerability scanners, security asset management, anti-malware sandboxes/cloud services, incident response platforms, and threat intelligence into a cohesive software architecture. In this way, disparate analytics tools can be used collectively to gain more context out of the data while accelerating processes and cybersecurity operations.To read this article in full or to leave a comment, please click here

