A paradigm shift is underway in the cybersecurity industry. Cybersecurity professionals are moving from a focus on attacker prevention to attacker detection. Preventing the “bad guys” from getting in is still important, but cyber adversaries are increasingly able to bypass even the most sophisticated network defenses. Once inside, it is more important than ever to find these attackers fast, before their activities get buried in the daily volume and pulse of network communications. This is where security analytics holds promise. Security analytics provides the necessary and timely visibility into normal and abnormal network behavior. This visibility enables devices and entities acting suspiciously to be quickly identified and investigated.