It is said that one piece of Information is like a penny, it’s value is small until it is combined with thousands of other pennies (or nickles, dimes or whatever). This is certainly true when we collect the windows process list or the output of netstat -naob across a domain (the last two stories I’ve written up) - any single line is of limited value. But once you combine everthing together, it’s easy to find trends, or in the case of the Windows process list, outliers - items that only occur on a few stations.
Article Link: https://isc.sans.edu/diary/rss/25074