CIO Greg Smithberger says the NSA is using automated capabilities “to up our game” for detecting and responding to anomalies, including anything from external attacks to suspicious internal activity. The NSA has similarly enhanced threat detection for its own network, which analysts, operatives and engineers use for a variety of intelligence-gathering tasks. Smithberger: The NSA is conducting real-time forensic analysis of cybersecurity software and appliances, including firewalls, VPNs and audit logs on every network device “so that we can observe things that humans cannot put together on their own””]
Source: https://www.csoonline.com/article/3012443/how-the-nsa-uses-behavior-analytics-to-detect-threats.html