Threat Stack announced new capabilities that help security teams quickly detect and remediate threats in cloud infrastructure. Threat Stack now enriches Linux host and container events in real time with EC2 metadata like VPC, security group, and DNS names. This added data allows customers to build targeted, infrastructure-aware rules, and machine learning models that dramatically reduce false positives and reduce alert investigation time to minutes. ThreatML, Threat Stack’s machine learning engine, collects, normalizes, and analyzes over 60 billion events per day.
Source: https://www.helpnetsecurity.com/2021/02/04/threat-stack-capabilities/