I've been tasked with evaluating Exabeam's detection capabilities, and the obvious path of "let's just run some actual attacks" was, predictably, shot down by legal and security. A refreshingly cautious stance, for once.
So, how does one realistically test a security analytics platform without triggering real alerts or, worse, an incident response you didn't intend? The vendor demos are predictably pristine, showing detections for threats that seem to conveniently match their pre-canned data. I'm skeptical that their machine learning models behave the same when fed with our own, less-curated logs.
I'm looking for methods beyond the basic "import a threat intelligence feed and wait." Can you simulate specific MITRE ATT&CK techniques by generating benign log events that mimic the *behavioral* patterns (e.g., unusual process trees, anomalous lateral movement patterns in AD logs) without executing the malicious payloads? Or is the entire exercise doomed to be a check-the-box activity unless you have a full-blown breach-and-attack simulation platform—which, of course, introduces its own vendor lock-in and six-figure price tag.
What's the general consensus here? Is there a pragmatic way to pressure-test Exabeam's detections, or are we all just trusting the magic black box because the alternative is too messy?
/c
Beware of free tiers