Question 1

What is a SIEM?

Accepted Answer

Security information and event management (SIEM) is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system.

Question 2

WHAT IS A SIEM TOOL?

Accepted Answer

A SIEM tool is a centralized system used to collect, store and analyse logs. Logs are generated in an infrastructure and originate from sources such as applications, hosts and network traffic.

Question 3

WHAT CAN A SIEM TOOL DO FOR MY COMPANY?

Accepted Answer

A SIEM tool is used to monitor and analyze the activities that are taking place in the infrastructure of your company. By analyzing the events, suspicious behavior can be detected. Analyzing the detected suspicious behavior. swiftly and correctly plays an essential role in recognizing a (potential) cyberattack in an early stage. Detecting these early, allows your company to act fast and take the necessary measures.

Question 4

HOW DOES A SIEM TOOL WORK?

Accepted Answer

The following steps will be performed by the SIEM and cyber security personnel continuously:

1. Log collection:

Logs and event data that is generated by applications, hosts, network devices and network traffic is collected by the SIEM.

2. Log processing:

The collected data is processed so that it can be stored in a structured matter. This process is also known as parsing.

3. Log analysis:

The stored data is used to provide an overview on the dashboard, report and potentially trigger an alert. On this data, real-time analysis will be performed in which detection rules can trigger an alert. This happens when certain conditions are met, that could indicate suspicious behaviour. Default detection rules might be available. However, customized detection rules can be created by a cyber security expert to meet specific security needs.

4. Alert analysis:

This step needs to be performed by a cyber security expert. Alerts are cues that might be an indication of compromise. When an alert is triggered, the SIEM can notify cyber security personnel to perform further analysis in order to determine whether a legitimate cyberattack is happening.

Question 5

WHICH SIEM TOOLS ARE THERE AND WHAT ARE THE MAIN DIFFERENCES BETWEEN THEM?

Accepted Answer

There are many SIEM solutions available today. They each differ slightly with regards to the type of log sources that are supported. Additionally, SIEMs differ in the monitoring capacity, price and “location” where they are deployed. Location refers to the place in your company’s infrastructure in which a SIEM is deployed. There are two main types:

· On-premise:

One of the two main categories is the on-premise SIEMs. This traditional option usually requires machines on location that need to be deployed and maintained. An example of a SIEM that requires on-premise machines is the LogRhythm NextGen SIEM.

· Cloud based:

Nowadays there are also cloud based SIEMs available. This type of SIEM does not require on-premise hardware as it is deployed in the cloud. Azure Sentinel is an example of a cloud based SIEM by Microsoft

Question 6

WHAT ARE IMPORTANT THINGS TO KEEP IN MIND WHEN I CONSIDER WORKING WITH A SIEM TOOL?

Accepted Answer

The following things needs to be kept in mind when you consider working with a SIEM:

· The SIEM solution needs to be a fit for your company’s infrastructure. It is important to think about whether your company wants to install on-premise machines on which the SIEM is deployed or to use a cloud based SIEM solution. It is also important to think about what kind of log data is being generated and whether it is supported by the SIEM solution you consider.

· Cost and maintenance for SIEM solutions can differ. The price, and how the cost is calculated, can differ for each SIEM solution. For instance, for cloud based SIEM solutions there can be costs based on the amount of data ingested into the cloud. Additionally, some SIEM solutions have licence-based subscriptions, or a combination of both. It is important to note that when a SIEM is deployed in the cloud, the costs for maintenance and hardware are small compared to a SIEM solution that is deployed on-premise.

· The detection rules in the SIEM needs to be configured to meet your company’s security needs. The SIEM’s default detection rules can be used and usually cover a wide range of known attacks. However, each company has its own crown jewels that need protection. This could require custom-made rules to detect specific attacks. Therefore, in addition to this, it is possible to create customized detection rules. It is important that this process is done by a cyber security expert in order to meet specific security needs your company may have.

· Specialised knowledge and experience are required to follow up on the alerts in the SIEM. A frequent misunderstanding is that a SIEM tool can prevent a cyberattack. This is not the case. Instead, a SIEM tool can detect cyber incidents in an early stage so that further escalation can be prevented. When suspicious behavior is detected, it needs to be analyzed swiftly by a cyber security expert in order to determine whether and which further actions are required.

Question 7

CAN I USE A SIEM TOOL BY MYSELF (SO NOT AS A SERVICE) AND WHY, WHY NOT?

Accepted Answer

To be certain that an alert is followed up properly and that further escalation of a cyber incident is avoided, cyber security expertise is required. An expert is needed to understand what is going on and how to respond accordingly. Hence, it is vital that a SIEM is only staffed internally when there are enough security experts available with the required knowledge, if this requirement cannot be met it is advised to outsource it to a security partner.

Question 8

WHAT IS SIEM AS A SERVICE?

Accepted Answer

SIEM As A Service comprises outsourcing the deployment, maintenance, and configuration of a SIEM in accordance with your company’s security needs. It is advisable that the outsourcing company has the required cyber security expertise. It is therefore important to be critical when looking for a security partner, this will ensure that the SIEM is correctly configured and your company’s security risks are covered.

Question 9

What is security information management (SIM)?

Accepted Answer

Security information management (SIM) is the practice of collecting, monitoring, and analyzing security-related data from computer logs. A security information management system (SIMS) automates that practice. Security information management is sometimes called security event management (SEM) or security information and event management (SIEM).

Question 10

Why is SIEM important?

Accepted Answer

SIEM is important because it makes it easier for enterprises to manage security by filtering massive amounts of security data and prioritizing the security alerts the software generates.

SIEM software enables organizations to detect incidents that may otherwise go undetected. The software analyzes the log entries to identify signs of malicious activity. In addition, since the system gathers events from different sources across the network, it can recreate the timeline of an attack, enabling a company to determine the nature of the attack and its impact on the business.

A SIEM system can also help an organization meet compliance requirements by automatically generating reports that include all the logged security events among these sources. Without SIEM software, the company would have to gather log data and compile the reports manually.

A SIEM system also enhances incident management by enabling the company's security team to uncover the route an attack takes across the network, identify the sources that were compromised and provide the automated tools to prevent the attacks in progress.

SECURITY THROUGH DATA

CYBER 101

Cyber Risks

Cyber Education

SIEM

Cyber Review: Cybersecurity Leadership

Cyber Review: Cybersecurity Leadership

CyberDecoded: AI vs Cybersecurity

CyberDecoded: Social Engineering

Cyber Heroes Comics Show: Shining the Light on Deep Fakes

CyberTip: Beware of Social Engineering

CyberDecoded: Malware – Why you should care

CyberTip: Be ready for the Quantum Threat to Cybersecurity

CyberDecoded: Quantum Computing vs Cybersecurity

CyberTip: How to spot a photo/video deepfake?

CyberDecoded: Decoding Deepfake

CyberStory: How One User “Hacked” Google Maps to Fake a Traffic Jam

CyberTip: Connect Securely

Frequently Asked Questions

BOOKS

Blue Team Handbook: Incident Response

COURSES & EDUCATION

GIAC Certified Detection Analyst (GCDA)

DEFINITIONS

Security Event Correlation (SEC) – Definition

DOCUMENTS

Why your Enterprise needs a SIEM Solution?

ENTERTAINMENT

Defense in Depth: Convergence -SIEM and SOAR

QUOTES

“While SIEMs are great for log storage, management and compliance, to fully utilize the SIEM’s threat detection….”

TOOLS

LogPoint SIEM tool – Tools

Welcome Back!

Retrieve your password

Add New Playlist