Brad Thomas

Why did you buy a SIEM?

Why did you buy a SIEM?

Of course, you take cyber security seriously and have spent a lot of money on tech to help you detect threats and protect your business from ransomware, IP theft, data theft and loss of PII. You also need to be compliant to regulations that are specific to your industry and boy are you paying for it. Cyber security is one of the biggest spend categories in IT still and shows no signs of slowing.

Of course you have SIEM. Everyone has SIEM. SIEM has always promised much, but has it really delivered? What promises are you paying for and have those promises been kept? Maybe there are a few things that you really need from SIEM but are you still paying extra for the undelivered promises?

Every vendor telling you they have the magic bullet that can solve all your cyber problems just compounds the issue and adds to the fatigue of managing risk with too few resources and not enough money.

So, let’s look at core SIEM capability and see what we really need.

  • Log collection and correlation – secure and complete collection of logs, normalisation and parsing of log data for analysis
  • Alerting – customisable thresholds for real time alerts.
  • Drill down into events – threat hunting through a combination or drill down and query based searching
  • Log storage, retention and forensics – ability to efficiently store (data compression, filtration and truncation) of log data for compliance and forensics
  • User monitoring – who’s doing what, with what systems and with what privileges?
  • Reporting and compliance – out of the box compliance reports for a range of use cases
  • Dashboards & Analytics – visualisation of areas of concern and policy management

The Cost of Your SIEM + A SIEM Alternative

Ultimately for most it is about finding indicators of compromise and eliminating false positives and avoiding “alert fatigue”.

This is probably what you are getting from your SIEM, but are you also paying for “AI” or “Machine Learning”, “anomaly detection”, “advanced UEBA” or other advanced functionality even its it’s not mature and is still of questionable value, or if you don’t have the team available to take advantage of it?

That’s another thing, many of these SIEM systems are large, complex, technically difficult to deploy and manage, policy is hard to apply and you need someone “driving it” constantly. Probably a team of people.

Many customers are not even sure that they are collecting all the logs they should be, as there is no mechanism to check the log collection capability to ensure collection, or the secure encryption of those logs in transit. Or worse still, they simply can’t afford to collect all the logs because the SIEM vendor charges by the GB.

The other major issue I see in the market is that many companies don’t have a SIEM – they have three! Consolidating these systems, sending the same logs to multiple destinations (including their MSSP partner) is almost impossible. Migration from one platform to another is hard and the vendor has locked you in because you are using their tool to collect the logs. Dammit!

Maybe your company is mid-size, growing, but not yet on the Fortune 2000 list. You still need to comply with regulation but cant afford the bells, whistles and promises of the big SIEM vendors or the expensive and skilled staff to manage these systems.  What do you do then? You need a SIEM alternative.

And so this brings us back to the original question. Why do you need (another) SIEM?

Maybe you don’t.

A very good Centralized Log Management platform (CLM) like Snare can give you all the core capability you need from SIEM at a fraction of the price and use a fraction of the resources. A good CLM can also add extra advanced functionality like File and Registry Monitoring (FIM & RIM) and Database Activity Monitoring (DAM) as well. You might even be able to rationalise some vendors with a good CLM like Snare and avoid vendor lock-in if you ever want to change.

So before you read the next “buyers guide” to selecting a SIEM – brought to you by “insert vendor here” have a look at a really good CLM platform like Snare as a SIEM alternative.

 

/by