Security Information and Event Management (SIEM) systems are essential IT security tools for countless small to medium businesses (SMBs) and enterprises. SIEM systems monitor log data from a vast number of applications and devices, looking for indications of suspicious activity or security events. To identify threats, SIEM rules generate too many false positives, says Andrew Hammond. Hammond: Rules offer many advantages for SOC teams defending against security threats such as malware and data breaches. Rules are poor defenses against Zero Day threats and other threats unknown to the security community at large, he says.”]