A SIEM tool provides visibility into cloud services and infrastructure, 以及集中日志数据, 威胁检测, and response.
InsightIDR产品Topic Overview
Security information and event management (SIEM) is a type of solution that detects security issues by centralizing, correlating, and analyzing data across an IT network. SIEM的核心功能包括 日志管理和集中, security event detection and reporting, and search capabilities. This combination helps companies meet compliance needs and identify and contain attackers faster.
SIEM tools work by leveraging three core capabilities to provide the security monitoring and visibility needed in today's hybrid and multi-cloud environments:
If compliance 报告是一个重要的驱动因素, a SIEM should also be able to assist with dashboards and ensure security policy is being enforced. 不管具体的规定是什么, you not only need to protect customer and sensitive data, but also proactively show your approach to key stakeholders and auditors by tracking and monitoring all access to network resources and critical systems.
A SIEM tool is used for providing better visibility into cloud services and infrastructure 以及集中日志数据, 威胁检测, and response. 更有知名度，也更现代 扩展检测和响应(XDR) 功能-大多数SIEM工具应该支持:
SIEM工具有许多用例, however it will take assessment and research to identify the solution that fits the specific needs of your 安全运营中心(SOC).
正确部署时, a SIEM offers organizations the visibility they need to measurably reduce risk across the entire network to detect both known and unknown threats. SIEM solutions have been around for the better part of two decades, and today’s modern SIEMs don’t quite resemble their original, 日志管理对应项.
As the security landscape has evolved, SIEMs have evolved as well (at least, some of them have). The most effective, automated solutions today include:
时间和准确性在这里很重要. With a SIEM tool, 您的公司每天可能会看到数十亿个事件, 有很多信息需要筛选. You need a SIEM solution that can verify what needs follow-up and, 同样重要的是, 什么是无害行为. 您的解决方案的适应性就越强, the better the chances you won't have a public relations nightmare or financial crisis on your hands.
这里有一个简短的清单 在一个 SIEM solution:
Setting up SIEM tools can be a complex task for even the most advanced security practitioner. But, when done correctly, it can eliminate blind spots across your network. The first step consists of understanding your existing network and security stack and figuring out how to collect log information from those points.
You’ll also need to consider planning for hardware if a software as a service (SaaS) storage option isn’t offered by the vendor. Finally, an ongoing step is to write rules to detect events of interest and create reports to highlight key metrics on overall network risk.
Managing logs effectively with your SIEM tool is essential for network visibility, compliance, and reliable 事件检测和响应. You as a security practitioner need the ability to ask questions of your data (usually using structured query language or SQL) to identify 入侵指标(ioc), find the users and systems affected, and share the final scope with remediation teams.
Managing logs usually involves indexing data and correlating it with other data sets. The end goal is to give you an easy way to search for threats from one unified dashboard.
After general setup, configuring your alerts and reports is key to being efficient with your SIEM. 作为一名安全从业者, you’ll need to constantly refine your SIEM to provide you with the important security events happening on your network.
A common problem with SIEM tools is that they produce too many un-prioritized alerts, more than the security team can take the time to investigate. That’s why it’s important to continuously tune new and existing rules to effectively find only the relevant threat actions.
有很多东西要记住，也有很多东西要吸收. But feeling overwhelmed can't stop you from taking action. 攻击的形式和规模各不相同, and understanding their full scope is not just something that's “nice to have.” When you use incident and detection response effectively, you start your company on a path to streamlining more tasks through a better understanding of what policies are working and which ones might need some work.
[The Lost Bots] Podcast Season 2, Episode 1: SIEM Deployment in 10 Minutes