A security system can collect thousands of events. But collecting events is not the difficult part. The difficult part is deciding: Which events actually matter? This is where the Risk Engine becomes an important part of CyberMoranda CIDS. The purpose of the Risk Engine is not to simply assign a large number to suspicious activity. Its purpose is to combine security evidence, context, and behavior into a defensible risk decision. From Events to Risk A simplified CIDS ...