SIEM tools’ detection methodologies are primarily based on correlation rules that look for known attacks at the points of entry. Such rules become ineffective as attacks become more complex, longer lasting, or more distributed. Next-gen tools are behavior and context aware, and models are used to track user behaviors, which makes it very effective to detect unknown threats and complex attack chains.Download this white paper to learn about:Difference between rules and models;Pros and cons of using rules or models.”]
Source: https://www.bankinfosecurity.com/whitepapers/rules-versus-models-in-your-siem-w-6524