Introduction to SIEM

June 17th, 2019

Introduction to SIEM. Everything you wanted to know about Log Management

As more businesses operate online, it’s increasingly important to incorporate cyber security tools and threat detection to prevent downtime. SIEM tools are an important part of the data security ecosystem: they aggregate data from multiple systems and analyze that data to catch abnormal behavior or potential cyberattacks.

What is SIEM?

SIEM (Security Information and Event Management) software centrally collects, stores, and analyzes logs from perimeter to end user. It monitors for security threats in real time for quick attack detection, containment, and response with holistic security reporting and compliance management.

When the attack occurs in a network using SIEM, the software provides insight into all the IT components (gateways, servers, firewalls, and so on).

SIEM is about looking at what’s happening on your network through a larger lens than can be provided via any one security control or information source.

SIEM is essentially nothing more than a management layer above your existing systems and security controls. It connects and unifies the information contained in your existing systems, allowing them to be analyzed and cross-referenced from a single interface.

SIEM is a perfect example of the ‘Garbage In, Garbage Out’ principle of computing: SIEM is only as useful as the information you put into it.

The more valid information depicting your network, systems, and behavior the SIEM has, the more effective it will be in helping you make effective detections, analyses, and responses in your security operations.

How does SIEM Work?

SIEM provides two primary capabilities to an Incident Response team:

Reporting and forensics about security incidents
Alerts based on analytics that match a certain rule set, indicating a security issue.

At its core, SIEM is a data aggregator, search, and reporting system. SIEM gathers immense amounts of data from your entire networked environment, consolidates and makes that data human accessible. With the data at your fingertips, you can research data security breaches with as much detail as needed.

Best Practices for Successful SIEM Implementation and Adoption

Determine Scope
Start by determining the scope of your SIEM implementation. You need policy-based rules defining what activities and logs your SIEM software should monitor. Use that policy and compare its rules to external compliance requirements so that you know exactly what kind of dashboard and reporting you require. You also need to get a clear picture of the costs involved in terms of procurement and overall deployment.
Tweak Correlation Rules
The true value of SIEM arises not from analyzing isolated events, but through applying correlation rules that can flag up various security events that you would never identify in isolation. Correlation says that if “x” and “y” events happen, this indicates a specific threat, and the software notifies system administrators.SIEM software comes with its own set of pre-configured correlation rules. A sensible approach to designing correlation rules is to enable everything by default and then tune the software to your needs by removing false positive.
Defend Your Network Boundaries
Vulnerable areas exist at the edge of networks that should be strictly monitored by SIEM software. Firewalls, routers, ports, and wireless access points are all potentially vulnerable areas. Make sure you are gathering log data from these network boundary points.
Have a Comprehensive Incident Response Plan
A huge part of the appeal of SIEM is that it provides real-time monitoring and alerts for IT threat detection, facilitating rapid responses to a range of security incidents. However, the onus for properly responding to these incidents falls on the organization that implements SIEM — not on the tool itself.
Continuously Refine & Test Your SIEM Deployment
SIEM doesn’t cater for a “set and forget” approach. Extensive planning and implementing slowly step-by-step are some best practices, but it’s also important to have a culture in place that emphasizes continuous refinement and improvement.

Top SIEM tools

Gartner judges SIEM tools on 3 capabilities: basic security monitoring, advanced threat detection, and forensics & incident response. Before choosing a SIEM tool, it’s important to evaluate your goals.

Below we take a look at some of the best SIEM tools in the market.

AlienVault Unified Security Management
Unlike other SIEM software, AlienVault® Unified Security Management® (USM) combines powerful SIEM and log management capabilities with other essential security tools—including asset discovery, vulnerability assessment, and intrusion detection (NIDS and HIDS)—to give you centralized security monitoring of networks and endpoints across your cloud and on‑premises environments–all from a single pane of glass. It is one of the most competitively priced SIEM solutions on the list.
IBM QRadar
Over the past few years or so, IBM’s answer to SIEM has established itself as one of the best products on the market. The platform offers a suite of log management, analytics, data collection, and intrusion detection features to help keep your network infrastructure up and running. All log management goes through one tool: QRadar Log Manager. When it comes to analytics, QRadar is a near-complete solution.
Splunk Enterprise Security
Splunk is one of the most popular SIEM management solutions in the world. What sets it apart from the competition is that it has incorporated analytics into the heart of its SIEM. Network and machine data can be monitored on a real-time basis as the system scours for potential vulnerabilities. Enterprise Security’s Notables function displays alerts that can be refined by the user.
LogRhythm Security Intelligence Platform
LogRhythm have long established themselves as pioneers within the SIEM solution sector. From behavioral analysis to log correlation and artificial intelligence, this platform has it all. The system is compatible with a massive range of devices and log types. In terms of configuring your settings, most activity is managed through the Deployment Manager.

OK, I’m ready to Get Started!

No matter what SIEM tool you choose to incorporate into your business, it’s important to adopt a SIEM solution slowly. This means adopting any solution on a piece-by-piece basis. You should aim to have both real-time monitoring and log analysis functions.

Mindfire Technologies has been at the forefront of digital transformation helping organizations adopt SIEM. Reach out to us and we’ll guide you through.