SIEM | Security Information & Event Management

What is a SIEM?

Security information and event management (SIEM) is a security technology that aggregates log data from multiple sources, identifies suspicious activity and takes appropriate action. The most basic and important function of a SIEM platform is to centralize security notifications from multiple security tools (like firewalls, IDS/IPS, wireless access points, antivirus software, etc.) that each generate their own alerts every day.

A SIEM solution helps you collect all these alerts in one place. It creates a single set of reports in a centralized system for generating notifications. This is also referred to as a log aggregation system.

Gartner defines SIEM as follows: Security information and event management (SIEM) technology supports threat detection and security incident response through the real-time collection and historical analysis of security events from a wide variety of event and contextual data sources. It also supports compliance reporting and incident investigation through analysis of historical data from these sources. The core capabilities of SIEM technology are a broad scope of event collection and the ability to correlate and analyze events across disparate sources.

How It Works

1 - COLLECT
Ingest Terabytes of data from all types of sources, such as applications, the cloud, servers, network devices and sensors.
2 - PARSE

Extract all relevant information from your logs based on extractor configuration.
3 - ENRICH

The enrichment phase adds context to events, which makes finding correlations between events easier and more productive. For example, Adding geographical information and whois records are common means of enriching data.
4 - STORE
After data ingestion, the parsed data is stored in a database. Traditional SIEM solutions typically use RDBMS storage systems.
5 - CORRELATE AND ANALYZE
Traditional SIEM solutions rely on pre-written correlation rules for threat detection. This rule-based correlation is geared toward finding known threats and generates an alert or signal for SOC analysts to review/validate.
6 - RESPOND
Response is the last phase, where alerts that are generated are validated by SOC teams for false positives and applicable remediation actions are performed.