security information and event management (SIEM)

How does SIEM work?

SIEM tools work by gathering event and log data created by host systems, applications and security devices, such as antivirus filters and firewalls, throughout a company's infrastructure and bringing that data together on a centralized platform. The SIEM tools identify and sort the data into such categories as successful and failed logins, malware activity and other likely malicious activity.

The SIEM software then generates security alerts when it identifies potential security issues. Using a set of predefined rules, organizations can set these alerts as low or high priority.

For instance, a user account that generates 25 failed login attempts in 25 minutes could be flagged as suspicious but still be set at a lower priority because the login attempts were probably made by the user who had probably forgotten his login information.

However, a user account that generates 130 failed login attempts in five minutes would be flagged as a high-priority event because it's most likely a brute-force attack in progress.

Why is SIEM important?

SIEM is important because it makes it easier for enterprises to manage security by filtering massive amounts of security data and prioritizing the security alerts the software generates.

SIEM software enables organizations to detect incidents that may otherwise go undetected. The software analyzes the log entries to identify signs of malicious activity. In addition, since the system gathers events from different sources across the network, it can recreate the timeline of an attack, enabling a company to determine the nature of the attack and its impact on the business.

A SIEM system can also help an organization meet compliance requirements by automatically generating reports that include all the logged security events among these sources. Without SIEM software, the company would have to gather log data and compile the reports manually.

A SIEM system also enhances incident management by enabling the company's security team to uncover the route an attack takes across the network, identify the sources that were compromised and provide the automated tools to prevent the attacks in progress.

Benefits of SIEM

Some of the benefits of SIEM include the following:

• shortens the time it takes to identify threats significantly, minimizing the damage from those threats;
• offers a holistic view of an organization's information security environment, making it easier to gather and analyze security information to keep systems safe -- all of an organization's data goes into a centralized repository where it is stored and easily accessible;
• can be used by companies for a variety of use cases that revolve around data or logs, including security programs, audit and compliance reporting, help desk and network troubleshooting;
• supports large amounts of data so organizations can continue to scale out and increase their data;
• provides threat detection and security alerts; and
• can perform detailed forensic analysis in the event of major security breaches.

Limitations of SIEM

Despite its benefits, there are still some limitations of SIEM, including the following:

• Usually, it takes a long time to implement because it requires support to ensure successful integration with an organization's security controls and the many hosts in its infrastructure. It typically takes 90 days or longer to install SIEM before it starts to work.
• It's expensive. The initial investment in SIEM can be in the hundreds of thousands of dollars. And the associated costs can also add up, including the costs of personnel to manage and monitor a SIEM implementation, annual support, and software or agents to collect data.
• Analyzing, configuring and integrating reports require the talent of experts. That's why some SIEM systems are managed directly within a security operations center (SOC), a centralized unit staffed by an information security team that deals with an organization's security issues.
• SIEM tools usually depend on rules to analyze all the recorded data. The problem is that a company's network generates a large number of alerts -- usually, 10,000 per day -- which may or may not be positive. Consequently, it's difficult to identify potential attacks because of the number of irrelevant logs.
• A misconfigured SIEM tool may miss important security events, making information risk management less effective.

SIEM tools and software

Some of the tools in the SIEM space include the following:

• Splunk. Splunk is a full on-premises SIEM system. Splunk supports security monitoring and offers advanced threat detection capabilities.
• IBM QRadar. QRadar can be deployed as a hardware appliance, a virtual appliance or a software appliance, depending on a company's needs and capacity. QRadar on Cloud is a cloud service delivered from IBM Cloud based on the QRadar SIEM product.
• LogRhythm. LogRhythm, a good SIEM system for smaller organizations, unifies SIEM, log management, network and endpoint monitoring and forensics, and security analytics.
• Exabeam. Exabeam's SIEM product offers several capabilities, including UEBA, a data lake, advanced analytics and a threat hunter.
• RSA. RSA NetWitness Platform is a threat detection and response tool that includes data acquisition, forwarding, storage and analysis. RSA also offers SOAR.

How to choose the right SIEM product

Selecting the right SIEM tool varies based on a number of factors, including an organization's budget and security posture.

However, companies should look for SIEM tools that offer the following capabilities:

• compliance reporting;
• incident response and forensics;
• database and server access monitoring;
• internal and external threat detection;
• real-time threat monitoring, correlation and analysis across a variety of applications and systems;
• intrusion detection system (IDS), IPS, firewall, event application log, and other application and system integrations;
• threat intelligence; and
• user activity monitoring (UAM).

History of SIEM

SIEM technology, which has existed since the mid-2000s, evolved initially from the log management discipline, the collective processes and policies used to administer and facilitate the generation, transmission, analysis, storage, archiving and ultimate disposal of the large volumes of log data created within an information system.

Gartner Inc. analysts coined the term SIEM in the 2005 Gartner report, "Improve IT Security with Vulnerability Management." In the report, the analysts proposed a new security information system based on SIM and SEM.

Built on legacy log collection management systems, SIM introduced long-term storage analysis and reporting on log data. SIM also integrated logs with threat intelligence. SEM addressed identifying, collecting, monitoring and reporting security-related events in software, systems or IT infrastructure.

Then, vendors created SIEM by combining SEM, which analyzes log and event data in real time, providing threat monitoring, event correlation and incident response, with SIM, which collects, analyzes and reports on log data.

The future of SIEM

The future trends of SIEM include the following:

• Improved orchestration. Currently, SIEM only provides companies with basic workflow automation. However, as organizations continue to grow, SIEM will need to offer additional capabilities. For example, because of the increased commercialization of AI and machine learning, SIEM tools will have to offer faster orchestration to provide the different departments within a company the same level of protection. Additionally, the security protocols and the execution of those protocols will be faster, as well as more effective and more efficient.
• Better collaboration with managed detection and response (MDR) tools. As threats of hacking and unauthorized access continue to increase, it's important that organizations implement a two-tier approach to detect and analyze security threats. A company's IT team can implement SIEM in-house, while a managed service provider (MSP) can implement the MDR tool.
• Enhanced cloud management and monitoring. SIEM vendors will improve the cloud management and monitoring capabilities of their tools to better meet the security needs of organizations that use the cloud.
• SIEM and SOAR will evolve into one tool. Look for traditional SIEM products to take on the benefits of SOAR; however, SOAR vendors will likely respond by expanding the capabilities of their products.