I would love to see LEM have an anomaly detection engine. Currently the problem with most SIEM products or even monitoring products in general is that it requires you know what problems it is that you want to see in advance so that you can configure the system to detect them. Unfortunately it's very often the case that the thing you need to know about is an unknown. With an anomaly detection engine LEM would be able to use algorithms to detect changes in patterns, deviations from "normal", and rare/unique events. All of these detected things would be based off machine learning, pattern recognition and algorithms versus per-configured thresholds and correlations. This would add a much needed layer of visibility into otherwise often undetected events.
While I have no idea how well it works, the idea for this in LEM came when I ran across the Prelert product.
I would love to hear what others think about this!
