Hi Vivek,
As per Christopher I agree on that "Security Analytics is a world-class network monitoring suite capable of identifying all sorts of traffic and log events". Though for zero day attack we cannot go for the specific ESA rules, App rules and capture attack, for this we need to create multiple scenarios using perimeter devices and internal device's logs.
For example :
For signature based detection we can use detection systems such as Anti-Virus, Intrusion Prevention Systems, Content Inspection Systems and Application Firewalls or if we identify suspicious behavior by users and computers that may have been compromised by a zero day exploit then the only method is that to determine 'intrusion' i.e. Large file transfers detected by network flows, attempts at accessing data outside of a compromised user’s environment, disabling of services, installation of software and other infrequent acts imply compromise.
Also if you are using packet in your environment then it is best to use feeds for IOCs(Indicator of compromise), BOCs(behaviour of compromise) and packs specifically configures for such malicious activities. Else you can use manual feeds for malwares, blacklist IPs, domains etc and from RSA live also in order to monitor threat category, threat description and create dashboard, correlation and rules and monitor the traffic, trend and analyze the risk and behavior. You can also go for some basic activities check in the environment i.e.
1.) Determine Malicious Authentication Attempts.
2.) Identify Compromised Account Activities.
3.) Determine Data Exfiltration and Methods (Use proxy logs to determine data exfilteration or any http outbound activity)
4.) Malware search dashboard for any compromised endpoint.
etc. Likewise you can create many checkpoint for malicious attacks, ransomwares, variants attacks etc.
