Part 1 of NextGen SIEM Series
BLUF: A new SIEM can offer enhanced Alert Management that reduces Mean Time to Respond.
In today’s fast-paced digital world, keeping costs low is key. Security pros are always looking for ways to cut budgets and automate everything while maintaining a low-risk profile. But Security Information and Event Management (SIEM) is a big ticket item when it comes to costs… and this has the C-suite raising their eyebrows.
Are we really getting our money’s worth from our SIEM? How can we figure out the real Total Cost of Ownership (TCO) for our SIEM? What does the future look like for our SIEM? One could see why the questions are surfacing.
With cost estimates of $1M annually, we get it! In this series, we intend to enlighten you on the Next-Gen SIEM to future-proof your security operations. We’ll zero in on Security Operations Centers and lay out a clear framework for evaluation, giving you the confidence to answer the big questions and decide if jumping to a new platform is the right move for your company.
Unraveling the 3 SIEM Categories
- Integrations
- Analytics
- Alert Management
Integrations
Key to smooth data onboarding and enrichment, integrations help organizations gather data through good old methods like Agents, Syslog, API Polling, or HTTP Webhook. Big players in the SIEM world, like Splunk and Sentinel, come with handy built-in tools and parsing tricks for easy data onboarding. But, keep in mind, that these tools’ costs depend on how much data you’re pulling in and filtering isn’t all that simple.
BOLO:
- Moving your data pipelines can be a pricey task, eating up a lot of time and there’s a real risk of missing some detections during the process.
- Analyze how the new SIEM can get your data onboard quickly without messing with your current systems too much.
- Utilize the downtime created from switching feeds over to look into a solution like Cribl Stream to help manage those pipelines better.
Analytics
The ability to query and visualize stored data and foster actionable insights plays a pivotal role when switching SIEMs. Dashboards, Workflows, and Alerts (a.k.a. Content) are crucial in this context.
Dashboards serve as the visual powerhouses of data representation.
Workflows facilitate the smooth investigation and triage of data.
Alerts prompt the user with synthesized warnings derived from a collection of events.
BOLO:
- Prebuilt dashboards, workflows, and alerts can seriously cut down on the time and hassle of operations.
- Keeping detection consistent and on-point in mixed cloud and SIEM environments is a must-have.
- Detection as Code, which is all about having a central spot where you keep all your detection rules, makes it super easy to push rules out to your analytics setup.
Alert Management
This pivotal feature aids in swift navigation from “New” to “Closed” alerts, while tracking each step of the process. SOAR (Security Orchestration, Automation, and Response) and ticketing systems emerge as the two primary technologies in this category.
BOLO:
- Automation tools such as Tines provide the ability to move alerts from the analytics platform to the “Active Channel” for the analysts.
Note: Tines has been a growing player in the SOAR space as they provide simple no-code solutions allowing easy administration and custom development. - Ticketing systems should provide support to analysts and guidance to leadership.
- The system should allow for seamless navigation of the alert to a closed/remediated status.
- At the same time, each step should be captured for analytics and reporting so leadership can properly assess the effectiveness of operations.
With these three categories, you can start to bifurcate features and costs to better comprehend the future of the SIEM. Up next, we will dissect costing categories and craft a matrix to aid in understanding cost control.
And as always, our shameless plug:
If you’re looking for support in the Integrations category to ensure timely delivery of data to your analytics engine of choice, SOI and Cribl can provide you a fully Managed Solution. Give your security team trust in the data and focus on what’s really important, reducing the risk profile of the company. Let us know how we can help.
