Highlights from Black Hat USA 2021

This article advocates for enriching security logs with data from the ServiceNow Configuration Management Database (CMDB) before sending them to SIEM or logging tools. By adding CMDB context – like asset ownership, criticality, and relationships – organizations can significantly improve threat detection, investigation speed, and overall security posture. This proactive approach moves beyond simple alerts to provide richer, more actionable insights into potential security incidents.