# Data Analysis as a Defender

<details>

<summary>Learning resources or book you should read</summary>

* <https://medium.com/dataman-in-ai/handbook-of-anomaly-detection-with-python-outlier-detection-1-introduction-c8f30f71961c> (Learn anomaly detection from basic)

</details>

## What you should learn

## The Basic&#x20;

One of the most important things to defend is to know a little bit about statistics and how to ask questions about the vast data you have by that I mean it is the sheer amount of logs that you are ingesting to your SIEM.

> **Statistic is the key**

Let's think about the data you have okay? you have

* Network (External IP Address, Internal IP Address, Bytes In, Bytes Out, Port, Protocol, and DNS)&#x20;
* Host (Event Log which includes a lot of information, command line, process creation, registry, authentication,...)
* Security Product (Alerts, signature,...)
* Application/Web Server (Access log, error,...)

-> In the end you get the point, a lot of data is sitting there and waiting to be analyzed -> In my opinion doing statistics basically baseline the system so how to do it?&#x20;

### \<Insert Statistic Technique>

### <br>
