Security information and event management (SIEM) tools ingest log data from a variety of network hardware and software and analyze the data in real-time. Their purpose is to correlate events and identify anomalies or patterns of behavior like traffic from suspicious IP addresses or unusual exfiltration of data that may indicate a breach. Prior to SIEMs, the logs and other data were often manually collected and logs from a variety of different technologies including servers, firewalls, antivirus, spam filters and more had to be collected, normalized and analyzed.
Even in small organizations, there could be over 300 software and hardware products producing logs and a large enterprise will likely have thousands. Before SIEMs, this was a brutally slow and costly process that was ripe with errors. Now, after ingesting and normalizing the logs, SIEMs typically have the ability to analyze the event data in real-time to provide the early detection of targeted attacks, advanced threats, and data breaches.
But how useful is that to building resilience in your organization? At a high level, the function of a SIEM sounds very similar to Managed Detection and Response (MDR) services available from a wide variety of Managed Security Service Providers (MSSPs), which is the better choice for your organization?
In this post, we’ll explore the value of a SIEM and how it compares to MDR services.
SIEMs have three critical capabilities in most organizations:
Most SIEM solutions have a variety of features and functionality, including:
Monitoring, documenting and analyzing system events is a crucial component of IT security, and SIEMs automate many of the processes involved. Namely, a SIEM handles two jobs that were once handled individually:
The SIEM combines the capabilities of SIM and SEM, providing real-time monitoring and analysis of security alerts generated by network hardware and applications. They employ or handle the following:
A SIEM solution can be a major force multiplier for a security team. By providing automatic data aggregation and analysis, it can enable analysts to rapidly identify potential threats that would otherwise be overlooked. However, a SIEM solution is not plug-and-play, it needs to be properly configured and used in order to effectively protect an organization against cyber threats.
A SIEM solution is designed to aggregate multiple sources of cybersecurity data and provide context to security analysts. This can be a major asset for incident and detection and response since data from multiple sources can often enable the detection of cybersecurity incidents that seem like harmless anomalies from the perspective of a single tool.
However, while access to data is important, more data is not necessarily better. The more data feeds that a SIEM has to ingest and process, the longer it will take to respond to analysts’ queries.
An effective SIEM requires a carefully curated collection of input feeds designed to provide maximum visibility without including excess data. Developing such a feed requires in-depth knowledge of cybersecurity and the sources of valuable data within an organization’s network.
SIEMs run on use cases. While a SIEM can automatically ingest data from an organization’s network, it needs to be told what to look for in that data. A SIEM use case defines a potential attack scenario and how to find it in the available data.
While some generalized SIEM use cases are available, it is also important to have tailored ones as well. The potential cybersecurity threats faced by a financial institution are very different from those seen in the retail sector. Maximizing SIEM effectiveness requires SIEM use cases tailored to the organization.
Defining these use cases requires deep cybersecurity expertise. The use case developer needs to know a potential attack vector, how it can be detected, and how to find that particular information within an organization’s network.
A SIEM solution is designed to filter out extraneous and false-positive alerts. However, it is not a perfect solution. While a SIEM may emit fewer alerts than a collection of standalone systems, alert volumes can still be high.
Attempting to manually manage security alerts can quickly overwhelm an organization’s security team. The average SOC receives over 10,000 alerts each day, and each alert must be viewed, triaged, investigated, and potentially responded to.
Most organizations lack the resources to handle this volume of alerts. As a result, some alerts are ignored or overlooked, leaving the organization unaware of potential attacks.
Managing a SIEM bears high upfront costs and requires significant technical expertise to operate effectively. Given this, it makes business sense to offload that responsibility to a service provider for faster deployment and lower operating costs, however the devil is in the details.
With a SIEM deployment, your cybersecurity team can choose which data logs are most critical to the security of the organization. You can calibrate your SIEM to analyze these logs and generate alerts on suspicious activity. With an MDR, you are restricted to the data logs the service provider is willing to review, and that list is often extremely limited. Some MSSPs only analyze around 5% of logs, archiving the rest in cold storage, and many offer little or no customization options to expand the logs analyzed.
If exploring MDR services over a SIEM, pay particular attention to the specifics of the data logs. Services described as a managed SIEM service are more likely to include broader analysis of logs, but it is not guaranteed. Naming of services across MSSPs is inconsistent and one company’s managed SIEM may look the same as another’s MDR service. SecureOps, by contrast, will tailor your managed security services to protect the data that is most important to you.
SIEMs are proven technology if deployed, implemented, and tuned correctly. However, the upfront cost, training, operating manpower, and complexity can be overwhelming for security teams. MSSPs are an effective way for organizations to access the benefits of a SIEM without recruiting the highly competitive expertise necessary. Moreover, MSSPs provide the ability to lease, rather than buy SIEM technology, delivering enormous upfront cost savings.
If you’re interested in the benefits of a SIEM platform, ensure you have the right expertise in-house to operate the tool effectively. If you lack those resources, a robust security partnership with the right MSSP can get you there.