Security Information & Event Management (SIEM)

How Do SIEM Tools Work?

SIEM tools work by leveraging three core capabilities to provide the security monitoring 和 可见性 needed in today's hybrid 和 multi-cloud environments:

1. Data collection: Collect 和 analyze data from across your entire network.
2. Threat 检测: Identify suspicious 和/or malicious behavior.
3. Threat 响应: 提供警报, 可见性, 和 actionable data to response teams so they can address an issue before it becomes serious.

If 合规 reporting is an important driver, a SIEM should also be able to assist with dashboards 和 ensure security policy is being enforced. Whatever the specific regulation, you not only need to protect customer 和 sensitive data, but also proactively show your approach to key stakeholders 和 auditors by tracking 和 monitoring all access to network resources 和 critical systems.

What is a SIEM tool used for? 

A SIEM tool is used for providing better 可见性 into cloud services 和 infrastructure as well as centralizing log data, threat detection，响应. With greater 可见性 - as well as modern extended detection 和响应 (XDR) capabilities - most SIEM tools should enable: 

• 搜索 和 visualization of security data
• 检测 of compromised users 和 lateral movement
• Identification of evolving attacker behavior 
• Monitoring of a remote workforce
• 20x faster investigations 和 incident response
• Automatic containment of compromised users 和 assets
• Solving multiple 合规 regulations 
• Streamlined case management

There are many use cases for a SIEM tool, however it will take assessment 和 research to identify the solution that fits the specific needs of your security operations center (SOC).

The Benefits of a SIEM

When deployed properly, a SIEM offers organizations the 可见性 they need to measurably reduce risk across the entire network to detect both known 和 unknown threats. SIEM solutions have been around for the better part of two decades, 和 today’s modern SIEMs don’t quite resemble their original, 日志管理 counterparts.

As the security l和scape has evolved, SIEMs have evolved as well (at least, some of them have). The most effective, automated solutions today include:

• Fewer false positives
• Accurate malware detection
• Comprehensive analysis of all infrastructure
• Ability to learn new threats
• Endpoint detection

What to Look for in a SIEM Solution

Time 和 accuracy matter here. With a SIEM tool, your company may see billions of events each day, 和 that's a lot of information to sift through. You need a SIEM solution that can verify what needs follow-up 和, just as important, what's harmless behavior. The more adaptive your solutions can be, the better the chances you won't have a public relations nightmare or financial crisis on your h和s. 

Here's a short checklist of what to look for in a SIEM solution:

• User Behavior analytics (UBA)
• Attacker Behavior Analytics (ABA)
• Deception technology (i.e. intruder traps)
• File Integrity Monitoring (FIM)
• Incident response
• Endpoint detection
• Performance metrics
• Visualization 和 reporting

Setting up a SIEM tool

Setting up SIEM tools can be a complex task for even the most advanced security practitioner. But, when done correctly, it can eliminate blind spots across your network. The first step consists of underst和ing your existing network 和 security stack 和 figuring out how to collect log information from those points.

You’ll also need to consider planning for hardware if a software as a service (SaaS) storage option isn’t offered by the vendor. 最后, an ongoing step is to write rules to detect events of interest 和 create reports to highlight key metrics on overall network risk. 

Managing logs in a SIEM

Managing logs effectively with your SIEM tool is essential for network 可见性, 合规, 和可靠的 incident detection 和响应. You as a security practitioner need the ability to ask questions of your data (usually using structured query language or SQL) to identify Indicators of Compromise (IoCs), find the users 和 systems affected, 和 share the final scope with remediation teams.

Managing logs usually involves indexing data 和 correlating it with other data sets. The end goal is to give you an easy way to search for threats from one unified dashboard.

Alerts 和 reporting with your SIEM tool

After general setup, configuring your alerts 和 reports is key to being efficient with your SIEM. As a security practitioner, you’ll need to constantly refine your SIEM to provide you with the important security events happening on your network.

A common problem with SIEM tools is that they produce too many un-prioritized alerts, more than the security team can take the time to investigate. That’s why it’s important to continuously tune new 和 existing rules to effectively find only the relevant threat actions.

It's a lot to remember, 和 a lot to take in. But feeling overwhelmed can't stop you from taking action. Attacks come in all shapes 和 sizes, 和 underst和ing their full scope is not just something that's “nice to have.” When you use incident 和 detection response effectively, you start your company on a path to streamlining more tasks through a better underst和ing of what policies are working 和 which ones might need some work.

Keep Reading About SIEM

Learn About Rapid7's SIEM & XDR产品

SIEM 新闻 from the Rapid7 博客

[The Lost Bots] Podcast Season 2, Episode 1: SIEM Deployment in 10 Minutes