Principal Components of Security Information Event Management.
Description: – Security Information and Event Management (SIEM) permits security team to get real time analysis on adversarial effects and security alerts that are produced by data sources. SIEM is a very influential solution of SOC and highly useful in regulatory compliance. Highly optimized and précised implementation of SIEM enables you to stay one step ahead of cyber-attacks and adversarial effects.
Author: Rohit D Sadgune / Amruta Sadgune
FAQ: –
- Principal Components of Security Information Event Management
- Capabilities of Security Information Event Management
- Why is SIEM Important?
- Best usage of SIEM
- Combinations of SIEM Usage
- SIEM Limitations
- Countermeasure on SIEM Limitations
Principal Components of Security Information Event Management (SIEM)
Security Information Event Management (SIEM) has separate set of essential components, or principal functions that has to be there in a successful Security Information Event Management (SIEM) implementation:
Logs aggregation:
Which includes log and event management. Security Information Event Management (SIEM) gathers together data and events from respective log sources to safeguard that no significant security event is missed.
Event Normalization:
This is concerned with how event data is transformed into relevant security insights.
Event Normalization is a process needed to get rid of irrelevant events from generated data through a filtering process. The primary role of event normalization process is to get relevant logs for futuristic analysis.
Logs Correlation:
Which is considered for common drift and attributes that would create relationship with non-identical logs together so that consequential and practical facts can be derived.
Log Indexing and Hunting Capabilities:
Big organization’s network footprint is very huge so each network source produces millions of event logs per seconds. SIEM solution provides filtering, sorting and search that helps analysts find the adversaries.
Security Logs Alerting:
Which requires a proper mechanized analysis of correlated events and generates vigilant message to notify IT security professionals of any potential threats.
Analytics Dashboards:
Which requires proper tools that can compute raw data into actionable form that is easier to understand, such as bar charts, link bubble charts, time line views, graphs.
Regulatory Compliance:
Which imply non identical tools that would mechanize to assemble compliance-related events, as well as produce reports that demonstrate the organization’s compliance to regulations.
Logs Retention:
Which addresses how the Packets, Processes and events are stored in the long run, as well as how quickly it is available for compliance reports, threat hunting and investigations.
Forensics Analysis:
Which enables you to access Packets, Processes and events data lives in non-identical nodes from different time slots and assemble them all together, usually by using a specific set of search criteria.
Scalable:
SIEM should be highly scalable regardless of source vendor, event format, type of functionality of data source, change or compliance requirement.
Principal Components of Security Information Event Management
Combinations of SIEM Usage
- SIEM and Compliance
- SIEM and Incident Analysis
- SIEM and Threat Hunting
- SIEM and Vulnerability Management
- SIEM and Threat Intelligence
Best usage of SIEM
- Hunt for north south traffic of the network and detect threats
- Analyze activities of HPA (Highly Privileged Accounts)
- Monitor critical assets of organization’s
- Correlate activities of account to assets
- Device monitoring
SIEM Limitations
- SIEM cannot promise you to detect zero-day attacks (unknown attacks) because it won’t have the rules or use cases needed to do this.
- Use human intelligence to prioritize adversarial effects and incidents.
- Without SIEM vendor expert it is very difficult to manage, maintain and scale and take out threat value from SIEM.
- Too many false positive alerts
- Ineffective in Cloud log sources and scale in cloud
Countermeasure on SIEM Limitations
- Using CLOUD SIEM salability will help to resolve the issue
- Using SIEM solution which has behavior analytics capabilities which will eliminate false positive
- Running SIEM on CLOUD will solve limitation of managing, maintaining, scalability. As we have over come from primary limitation of SIEM now organization can invest more in resourcing of security experts.
- Use SIEM which has inbuilt potential of AI. Artificial Intelligence in SIEM will help to sort incidents based on historical behavior. This will overcome from limitation of human intelligence in SIEM.
