Real-time threat detection in enterprise networks: Integrating cisco umbrella, stealthwatch, and siem platforms

Abstract

Because cyber threats are becoming more complicated in business settings, companies need to move from using separate security technologies to using integrated, real-time detection frameworks. This study looked at how well using Cisco Umbrella, Cisco Stealthwatch, and a Security Information and Event Management (SIEM) platform together may make threats easier to see, more accurately detected, and more quickly responded to. We used a simulated enterprise network to recreate actual attack situations, both before and after the platforms were integrated. A quantitative study of important measures, such as the detection rate, mean time to detect (MTTD), mean time to reply (MTTR), and correlation efficiency, showed that performance improved significantly after integration. The unified system found 94% of threats, cut response times by more than half, and greatly lowered the number of false positives and missed threats. The results showed that multi-layered, telemetry-rich integration made it much easier for an organization to find and deal with threats in real time. This is a scalable solution for today's cybersecurity problems in businesses.