Security information and event management (SIEM)

What is a SIEM?

Security Information and Event Management

• Combination of Security Information Management (SIM) and Security Event Management (SEM)

• Collect and centralize logs from systems and security solutions

Review

Data centralization

Integration with data sources

Automating data analysis

Event alerting

For some SIEM solutions, threat prevention!

Collecting and centralizing data

How does a SIEM collect and centralize data?

Integrating your SIEM with data sources allows it to pull system, database, web server, firewall and other types of logs

Benefits of collecting data with a SIEM

• Centralization (as you know)

• Aggregation

• Correlation

• Removal of duplicate events

Performing data analysis

Manual analysis

• Simpler due to centralized data

• Singular format for data/logs

• Reduced number of events to review

  • Due to aggregation, correlation and removal of duplicated

Automated

• Rules governing analysis

• Easily scan through vast amounts of data

• Event-based alerting and threat prevention

Commercial SIEM solutions

Advantages of using a commercial SIEM

• Pay-to-use

• Additional features (over the free version)

• Dedicated help personnel

• More-frequent updates/patches

Popular commercial SIEM solutions

• Splunk Enterprise Security (ES)

• AlienVault Unified Security Management (USM)

• McAfee Enterprise Security Manager (ESM)

• IBM Security QRadar

Open-Source SIEM solutions

Advantages of using an open-source SIEM

• Free

• Generally, greater visibility into threat intelligence data

• Less support

• But you can often contribute to the tool

Popular open-source SIEM solutions

• AlienVault Open-Source SIEM (OSSIM)

• ELK/Elastic Stak - Elasticsearch, Logstash and Kibana

• SIEMonster

Securing your SIEM

Why should you secure/monitor your SIEM?

SIEM controls all data from logs

If compromised, attacker gains:

• Sensitive data

• Extreme visibility of network/security infrastructure

How can you secure/monitor your SIEM?

• System hardening

• Updates and patches

• Monitoring the monitor - similar to other sensitive servers