Security Information Event Management (SIEM)

As cybersecurity became more complex, the tools used to detect and respond to threats needed to evolve as well.
Modern SIEM solutions bring together historical data, real-time event log management, and threat intelligence to help identify abnormal activity and potential vulnerabilities that indicate a security incident.
As organizations moved their operations to the cloud, SIEM solutions also needed to aggregate new types of data and leverage new technologies, including integrations with:
User and Entity Behavior Analytics (UEBA): artificial intelligence (AI) and machine learning (ML) that monitor how people access and use resources to detect abnormal behaviors that might indicate fraud or credential theft Security Orchestration and Automation (SOAR): automated incident response technologies that leverage SIEM detection capabilities to mitigate threats faster Managed Detection and Response (MDR): outsourced teams who have access to technologies and databases that might be cost-ineffective for a single organization After collecting the information, the SIEM solution prioritizes the different alerts based on potential impact. By prioritizing data, SIEMs enable organizations to reduce the number of false positives that their security teams need to investigate.

Deciding to deploy a SIEM can be a huge undertaking for an organization. However, as your company scales, you might find that the benefits more than compensate for the cost.
Better security KPIs With all data aggregated in a single location, you gain better visibility into your security posture. This means that when an incident occurs, your team can more rapidly find the source and reduce key metrics like time to detect, respond, and remediate.
Better security KPIs:
With all data aggregated in a single location, you gain better visibility into your security posture. This means that when an incident occurs, your team can more rapidly find the source and reduce key metrics like time to detect, respond, and remediate.
Increased efficiency:
Security teams spend an inordinate amount of time researching alerts that turn out to be false alarms. By aggregating and correlating data, SIEMs reduce the number of false positives. This means that your security team is more efficient, spending their time and expertise on alerts that matter.
Reduced operational costs:
Because multiple teams can use the SIEM, you reduce operational costs. Your security team can use a SIEM for threat hunting and research. Your compliance team can use the SIEM for audit reporting. Your IT team can use the SIEM for troubleshooting. Even though the cost might appear high, SIEMs provide cross-functional capabilities that enable greater collaboration.

Data aggregation:
They should be able to collect and aggregate event log data from all critical systems.
A SIEM should collect data from the following types of information:
Security event data, including:
Intrusion detection systems (IDS)
Endpoint security solutions, like antivirus and antimalware
Data loss prevention (DLP) tools
VPNs
Web filters
Honeypots
Firewalls
Network logs, including:
Routers
Switches
DNS Servers
Wireless access points
WAN
Data transfers
Private Cloud Networks (VPC)
Applications and devices, including:
Application servers
Databases
Intranet applications
Web applications
Software-as-a-Service (SaaS) applications
Cloud-hosted servers
End-user workstations
Mobile devices, like smartphones and tablets
Infrastructure
Configurations
Location
Owners
Network maps
Vulnerability reports
Asset inventories

As IT stacks become more complex, organizations look for different ways to deploy their SIEM solutions. Four basic deployment models exist.
Self-hosted and managed:
This is the traditional model where you host the SIEM in your data center. You are responsible for everything. You own the appliance. You also have staff to maintain and manage the SIEM. For organizations that already have a SIEM infrastructure, this is often the best option.
Cloud-based, self-managed:
Based in the cloud, you have a managed security services provider (MSSP) who handles data collection, organization, and aggregation. Meanwhile, you focus on correlating and analyzing data to fine-tune alerts and dashboards. Many organizations are moving toward a cloud-based model to leverage the cloud’s elasticity. SIEMs require a lot of data storage capacity, so the cloud is often a good fit for organizations looking to reduce costs.
Self-hosted, dually-managed:
Similar to the first option, your organization purchases the software and hardware. However, unlike the first option, your team works with an MSSP to deploy the SIEM. This means that you have a partner to help with event collection, data aggregation, correlation, and analysis. You also have someone who can help you fine-tune your alerts and dashboards. If you have the storage capacity, but you have a staffing issue, then this might be a good option. You can fill in the skills gap by working with an MSSP who has the staffing and knowledge.