What Gives SIEM a Good Name?

Published on
4,544 Points
2 Endorsements
Last Modified:
madunix (Fadi SODAH)
Over the years, been involved in systems administration, networks, open source, security, audit and infrastructure. Made from 100% Geek.
SIEM must examine concepts of normality and abnormality traffic/data flow patterns. SIEM need to constitute use of adaptive intelligence. Companies need to evaluate SIEM products based on their own objectives to determine the product that best meet their needs.


Traditional security monitoring is often focused on system and network logs, which nonetheless supply a big bulk of useful security information. An efficient system should be able to gather, consolidate, and normalize data from a mixture of different logs and information sources, and send this information to a secure database where it can be examined.

Security Information and Event Management (SIEM) solutions [1] provide real-time or near- real-time analysis of security alerts generated by network hardware and applications. SIEM technology is often used to provide expanded insights into intrusion detection and prevention through the aggregation and correlation of security intelligence. SIEM solutions can be implemented as software, hardware appliances, or outsourced managed services.

SIEM collects data from many other sources within the network. It provides real-time monitoring of traffic and analysis and notification of potential attacks. Additionally, it provides long-term storage of data, allowing security professionals to analyze the data.

A SIEM typically includes various characteristics. Because it gathers data from dissimilar devices, it lets in a correlation and aggregation feature converting this data into useful information. Advanced analytic tools within the SIEM can analyze the data and raise alerts and/or trigger responses based on preconfigured rules.

Tasks may be performed automatically for you with tools such as Security Information and Event Management (SIEM):

• Filter out unnecessary or duplicate information

• Combine sources

• Synchronize events logged in different origins

• Normalize data formats

• Store data securely

• Data Collection, Analysis, and Correlation

SIEM Configuration

A SIEM handles the job of several analysts by correlating logs and producing meaningful reports. SIEM products attempt to aggregate real-time security events from multiple data sources into an integrated real-time analysis system. SIEM are most useful when they receive information from a wide variety of sources, which they can aggregate to reveal better insights than any of those sources can produce alone.

Stick to these guidelines when configuring your SIEM [4]:

• Configure your SIEM to aggregate information from many boundaries, network, and data defenses, such as firewalls, intrusion detection, enterprise malware tools, and data loss prevention, where they can drive reports and alerts, and be correlated with other events to provide improved security intelligence.

• Configure your SIEM to identity unauthorized assets and software. By using the SIEM to maintain your inventory of authorized assets and software, you deliver a reference baseline.

• Use the SIEM to monitor configurations of hardware and software on servers, workstations, and notebook computers, and provide alerts when a misconfiguration is identified.

• Use the SIEM to monitor configurations of wireless devices and wireless intrusions, and provide alerts when a misconfiguration is identified.

• Use the SIEM to monitor configurations of rules, policies, access control, and other configuration on network devices such as firewalls, routers, and switches.

• Configure the SIEM to report on the unnecessary use of administrator privileges, such as a user with administrative access running a web browser on a server.

• Correlate user activities with user rights and roles to discover violations of least privilege enforcement.

• Configure the SIEM to perform continuous vulnerability assessment and remediation.

Log Management

Logs are particularly useful when investigating security incidents. These logs provide records of the connections between systems and the amount of data transferred. The organization can use logs to re-create events leading up to and during an incident, but only if the logs haven’t been modified. If attackers can modify the logs, they can wipe out their activity, effectively negating the value of the information. It is important to protect log files against unauthorized access and unauthorized alteration [1].

It is common to store copies of logs on a central system, such as a SIEM, to protect it. Even if an attack modifies or corrupts the original files, personnel can still use the copy to view the events. One room to protect log files is by delegating permissions to determine their access. Organizations often have strict policies mandating backups of log files.

Security controls such as setting logs to read-only, assigning permissions, and implementing physical security controls protect archived logs from unauthorized access and modifications. It is important to destroy logs when they are no longer required.

Logging systems should also make use of the Network Time Protocol (NTP) to ensure that the clocks are synchronized on systems sending log entries to the SIEM as well as the SIEM itself. This ensures that information from multiple sources has a consistent timeline.

Market Player

SIEM market major players are IBM, Splunk, LogRhythm, ArcSight and AlienVault as stated in this Report “Security Information and Event Management (SIEM) Buyer's Guide and Reviews May 2018” [3]. This report is made up of a list of enterprise level Security Information and Event Management (SIEM) vendors. The reviewers of these products have been validated as real users based on their LinkedIn profiles to ensure that they provide reliable opinions and not those of product vendors. The Report included the following subjects for evaluation:


• Valuable features

• Improvements to my organization

• Room for improvement

• Pricing, setup cost, and Licensing

How to choose the right SIEM solution?

It is important to assure that the chosen solution meets immediate tactical requirements (i.e. Log management to meet specific compliance requirements) and longer-term strategic requirements and includes: security information and event management, network activity monitoring, advanced threat detection, vulnerability monitoring, and/or risk management, among other things. The following proposal items define requirements for the choice of a SIEM solution. It has been split into multiple logically connected sections. The SIEM must provide following requirements: (Only a few points are listed)

Administration   and Configuration Requirements
Auto-discovery of assets that are being protected or supervised.
Automated categorization of assets that are being protected.
API for access to data stored in the information database(s).
Ability to encrypt communications between components.
Integrate with 3rd party directory systems, as an authentication method.

Operational Requirements
Enable a phased roll out of log management and security intelligence functions.
Framework for future expansion and integration with other 3 rd party solutions.
Demonstrate ease of usage.
Maintain high availability.
Automate internal health checks and notify the user when problems come up.
Power to deliver multiple dashboards that can be customized.
Maintain a database of all assets discovered on the network.

Architectural Requirements
Integrate with other security and network intelligence solutions.
Easily expand to support additional demand.
Distributed database for event and network activity collection.
Ensure the integrity of the information collected.
A distributed model for correlation.
Transparent retrieval, aggregation, sorting, filtering, and   analysis of data across all components.
Passive asset  discovery to allow new or possibly unauthorized devices to be tracked.

Log Collection, Retention and Processing Requirements
Log collection and  archive architecture support both   short-term and long-term event storage.
Log archives on 3 rd  party storage.
Capabilities for efficient storage and compression of collected data.
Agent-less collection of event logs whenever possible.
Ability to distribute both event storage and processing across the entire log management.
Long-term access to detailed security event and network flow data.
Simple   architecture with a single appliance to collect logs and network flow data.

Log normalization and categorization Requirements
Ability to store/retain both normalized and the original raw format of the event log.
The ability to normalize and aggregate event fields.
Real-time event view of monitored information in raw/original as well as processed/parsed.

Event Filtering and Analysis Requirements
Near-real-time analysis of events.
Long-term trend analysis of events.
The ability to aggregate and analyze events based on a user-specified filter.
More advanced event drill down when required.
The real-time streaming  view that supports full filtering capabilities.
Alerting based on observed anomalies and behavioral changes in network and security events.
Maintain a history of user authentication activity on a per asset basis.
Roll up all events and network flows into single offenses.
Identify certain protocols that need to be monitored and controlled.
Profile traffic by application type.

Reporting Requirements
Configurable reporting engine for customized report creation (incl. Templates).
Out-of-the-box reports for specific compliance regulations and control frameworks.
Dashboard for quick visualization.
Automated distribution of reports.
Capability to provide historical trend reports.
Ability to centrally deliver vulnerability reports and asset reports.
Ability to generate reports on flows and events
Ability to search and data/log management.

Correlation  and Alerting Requirements
Alerting based on observed security threats from monitored devices.
The ability to correlate information across potentially disparate devices.
Alerting based on observed anomalies and behavioral changes in network activity.
Alerting based on established policy.
Weighted alerts to allow for prioritization.
Ability to take action upon receiving an alert.
The ability to correlate with 3 rd party security data feeds and vulnerability scan results.
Monitor and alert when there is a disruption in log collection from a device.
An out of the box mechanism to discover and classify assets by system type.
The correlation for a missing sequence and additive values over time.
Mechanism to optimize rule tuning.
Correlation in real time.

Network Activity Monitoring Requirements
Display visual traffic profiles in terms of bytes, packet rates and a number of hosts.
Application definition beyond protocol and port.
Ability detects “zero-day” events.
Dynamically learn behavioral norms and expose changes as they occur.
Detect denial-of-service ( DoS ) and distributed denial-of-service (DDoS)   attacks.
Detect and present views of traffic pertaining to observed threats in  the network.
Identify network traffic from potentially risky applications.
Display traffic profiles in terms of packet rate.
Profile and present information in multiple time frames.
The support level of customization.
Collection and analysis of packet capture data.
Ability to extract specific attribute and use the fields in correlation  rules.
Identify network traffic within a virtual network environment.
Ability to contextually link application activity on the network with security.

Advanced Threat Management Requirements
Ability to contextually link reported security events with real-time knowledge of the assets.
Ability to automatically weigh the priority of reported security events according to importance.
Ability to  automatically weigh the severity of reported security events.
Ability to assign credibility ratings to monitored security devices.
Forensics must include originally logged events with access to raw events at any time.

Workflow Requirements
Ability to send notification of correlated alerts.
An embedded workflow capability that security operations staff can use to guide their work.
Bi-directional integration with 3 rd party trouble ticketing/help desk systems.
Mechanism to capture all relevant aspects of a security incident in a single logical view.  
Mechanism to  annotate a security incident as it is addressed by the security operations staff.
Mechanism to track security incidents across a wide range of relevant attributes.

Risk Management Requirements
Have the ability  to compare the configuration of a device when configuration changes occur.
Detect and notify configuration change.
Provide a Layer 2/Layer 3 topology of how the network is configured.
Prioritize vulnerabilities in such a way to allow the vulnerability to be compromised.

Data Source Requirements
Ability to observe all information collected from all devices and services.
Ability to observe all information industries-leading vulnerability scanners.
Ability to understand virtual host within a virtualized environment looking for suspicious activity.
Support the ability to create custom device support at no additional cost.

Incident Forensics Requirements
Must include full packet capture and network forensics capabilities
The incident forensics analysis tool must accept input from multiple 3 rd party packet capture.
The packet capture and incident forensics capabilities should be especially well equipped.
The packet capture capability needs to be expansive and accommodating of the need to retain information.


SIEM is mostly used where compliance [1], [2] with regulations remains a strength.


• Recommended for PCI-DSS deployments

• Recommended for Threat Analytics and Security best practice

• Recommended for various compliance mandates

Observe these guidelines [4] to insure that your use of a SIEM will enable you to substantiate compliance:


• Preserve data as required in their original forms. SIEM generate new versions of data that may not satisfy some compliance requirements. Be careful to preserve original logs and other data that might be required by applicable regulations and standards.

• To support compliance regulations and help ensure follow-up, configure the SIEM, if possible, to generate important alerts in a form such as support tickets, which automatically document threats you have detected and are following up on.

• Review your logs on a frequent, regular basis.

• Ensure that SIEM monitoring can generate documentation to prove that your arrangements are frequently scanned for threats and that log and alerts are regularly reviewed by personnel.


In reality, it is impractical for people to continuously monitor system configurations and traffic activities. However, automation tools such as SIEM systems can help by continuously monitoring items such as software configurations, traffic activities, access controls, and generating an alert when a change to the system has resulted in a potential security problem that can be resolved by taking specific corrective actions.

SIEM, it is one of the most powerful log analysis tools available to you [5]. A properly configured SIEM can provide you with incredible insight into your security intelligence within your IT environment, which assists to build your technical infrastructure invincible.


You’ll find it useful to review Security Institute (SANS) and the National Institute of Standards (NIST) documents when developing for the SIEM solution to yield you a fuller idea of different security concepts for log and threat management.

[1] https://csrc.nist.gov/publications/detail/sp/800-92/final

[2] https://www.sans.org/

[3] https://toolbox.itcentralstation.com/categories/security-information-and-event-management-siem

[4] http://logicaloperations.com/certifications/1/CyberSec-First-Responder/  (Section: CyberSec First Responder: Threat Detection and Response - Analyzing Log Data)

[5] http://public.brighttalk.com/resource/core/197693/security-platform_web-april-2018_418795.pdf

1 Comment

Expert Comment

by:Gökhan POLAT
Great article 👍

Featured Post

INTRODUCING: WatchGuard's New MFA Solution

WatchGuard is proud to announce the launch of AuthPoint, a powerful, yet simple, Cloud-based MFA service designed to eliminate the vulnerabilities that put your data, systems, and users at risk.

Join & Write a Comment

Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month