For broad detection/response coverage across on-prem and cloud environments using SecOps and GTI, which single action best advances event-based integration?

• A. Ingest GTI IOCs into SecOps as events.
• B. Ingest on-prem and cloud security logs into SecOps SIEM as events.
• C. Ingest on-prem/cloud logs into SIEM as entities.
• D. Use SOAR integrations with GTI for event enrichment.

Answer: (B)

Centralizing event data from both on-prem and cloud sources into the SecOps SIEM as events is the most effective way to enable detections and responses that span hybrid environments. When logs from all environments are ingested as normalized events, the SIEM can correlate activities across different platforms, build comprehensive detection rules, and provide unified visibility and response workflows. This creates a true cross-environment picture, which is essential for detecting complex threats that move between on-prem and cloud.

Ingesting GTI indicators alone as events can help by signaling known bad indicators, but it doesn’t provide the full context or sequence of activities needed to detect broader or novel attacks across multiple sources. Relying solely on indicators limits coverage to what’s known, and you lose the richer story that comes from actual log events across environments.

Ingesting logs as entities shifts the data model away from events the detections rely on. Entities are useful for asset-centric enrichment, but they don’t deliver the event-driven correlations and timelines needed for comprehensive SecOps visibility and response.

SOAR integrations with GTI for event enrichment are valuable, but they depend on having a broad set of events to enrich. The foundational step to achieve cross-environment event-based integration is bringing all relevant logs into the SIEM as events, enabling unified detection, correlation, and response across on-prem and cloud.