Expel @ Black Hat USA: Booth #3009
A practical example of how you can make a weak signal actionable by combining events from your endpoint and network security tech into one meaningful alert.