The early detection of cyber threats with cyber-attacks adapted to the nature of information systems is a crucial cybersecurity problem. This problem and the task of recognizing normal and abnormal states and behavior of various processes in information systems are closely related. An additional condition is often the absence of templates, signatures, or rules of normal behavior that would allow the use of existing statistical or other known data analysis methods. We analyze the existing and propose a new method for detecting abnormal behavior without using signatures based on the finite state machine (FSM) model and the Security Information and Events Management (SIEM) system. © 2023, Springer Science+Business Media, LLC, part of Springer Nature.