data collection and virtualization helps analysts quickly character- ize the attacks, and smart agents automatically update the policies in ASTRA. These new policies propagate quickly across all existing and new cloud assets. Today's constantly evolving cyber threat landscape demands relentless focus on security. With strong identity and access management, the ASTRA policy engine, and security analytics platform are impor- tant part of what is needed to orchestrate a robust, automated, and multilayered cloud defense strategy. 9.5.1 SECURITY ANALYTICS There are two fundamental functions of security analytics: First and foremost, the purpose of security analytics is to identify potential misuse, abuse, or attack behavior that was not originally anticipated. For this, the objective is to define general analysis or tools that can be used to detect a wide variety of abuses. Building the Network of the Future These generally fall into two categories. (i) signature-based detection (use of identifiers to detect symptoms of known attacks and abuses) and (ii) behavioral analysis (detection of anomalies in activity, and determining whether the anomaly is relevant to security). 2. If or when indications or suspicions exist that there is a security issue, security analyt- ics provides the means to investigate (i.e., hunt) for further evidence of the issue and to provide the means for learning what activities are needed to remediate the issue. In a network service environment, there are two perspectives: 1. Verify the integrity of the platforms providing the service. In this perspective, no infec- tion is acceptable. This includes focusing on the integrity of the cloud infrastructure that hosts applications, assuring tenant applications within the cloud infrastructure are secure, and assuring that any control functions associated with creating, removing, and configuring the infrastructure and applications are protected from unauthorized changes. 2. Verify activities on the service are not going to impact availability of the se