Fig. 4From: OMMA: open architecture for Operator-guided Monitoring of Multi-step AttacksGlobal architecture of OMMA (Operator-guided Monitoring of Multi-step Attacks). E in = input events filtered by the Collector. E out = enriched eventsBack to article page