Your security team needs a new SIEM platform. How do you choose the best one?

Consider Gartner ratings, prioritize key features, assess scalability, integration, usability, and automation. Factor in costs, threat intelligence, compliance support, and community strength. Verify compatibility with third-party products, explore costs, recent investments, and innovations. Ensure seamless integration with existing tools and adaptability to evolving security challenges. This approach empowers your team to align their decision with the organization's needs.

Here are some pointers to help you choose the best SIEM platform for your security team: 1. Define Requirements and Objectives: Clearly outline your organization's specific security needs and objectives. 2. Integration with Existing Infrastructure: Determine how well the SIEM platform integrates with your existing security infrastructure, including firewalls, IDS/IPS, antivirus solutions, and other security tools. 3. Ease of Use and User Interface: Evaluate the user interface and overall usability of the SIEM platform. 4.. Compliance and Reporting: Check the SIEM platform's ability to assist with compliance reporting for regulatory requirements.

When you're considering SIEMs, a couple of key considerations: - What will you use it for? Detection, hunting, correlation, feeder into something else? - What skillset does your workforce have? - What is your company culture: build or buy These questions will not only provide a rubric to judge the best fit of an SIEM but also ensure organizations consider the implementation and maintentail tails involved with any specific SIEM. It's more than just what SIEM can do X but what how your organization can beat integrate the technology into your organization.

Choosing the right SIEM platform involves various factors. Starting with a risk assessment provides a solid foundation to begin the journey toward selecting the right platform. Budget constraints and senior management commitments play a crucial role in progressing the assessment into a reality. With many tools available today, the best choice depends on factors like budget, current staff capacity (including engineers to fine-tune the platform and analysts' incident response capacity), organizational maturity, and more. Since the tool plays a pivotal role in a SOC journey, selecting an effective one is essential for optimal performance.

SIEM’s are now essential systems to have in your cyber defense but they are only as good as the analysts you have operating them and the security teams that utilse them. I have worked with many companies that have implemented MS Sentinel or Splunk only to find that they had lots of alerts and no one that could filter out the false positives. The more you integrate with your SIEM the better visibility of your attack surface, but if you can’t see the wood for the trees it will end up being another system that will generate alerts that are ignored.

SIEM's are generally large, complicated platforms, smaller organisations can struggle to have the team to manage this. Seek help in this instance with an MSP/RSP who can help deliver the solution and then help with the day to day run/maintenance of the platform. If you are big / lucky enough to have your own team, make sure they are sufficiently skilled in the new product and invest in their uplift if not. SaaS/Cloud based products have an advantage of reducing operational overhead, at the cost of loss of control of the infra and the risk of a 3rd party now managing a critical security control. Ensure this aligns with your orgs risk appetite. Don't forget this control is now 100% reliant on reliable network transit to the cloud to function.

A SIEM is not a solution that is only operated 8x5. A decision must be made as to what should happen outside normal working hours and at weekends. Should the solution be operated in-house or outsourced? Does a hybrid approach perhaps also make sense?

Considering your resources is essential. This includes evaluating the amount of money, time, and staff available to establish and oversee a SIEM platform. It is also important to assess the necessary training and support needed to effectively utilize the platform. Furthermore, the platform's adaptability and flexibility in meeting your evolving needs and expansion should be taken into account. It is crucial to choose a SIEM platform that aligns with your resource limitations and offers a positive return on investment. Additionally, it is vital to avoid hidden costs such as licensing fees, hardware upgrades, or additional services.

On the aspect of evaluating my resources I will have to consider the cost of ownership,licensing, deployment of the platform, cost of maintance and also how much it will cost the security team to get additional features and support. I would not support buying tools that the Organization will have to struggle to maintain.

On the issue of comparing my options, I will have to look at three (3) major things which are: 1 I will have to assess the vendor support system in place,and how it is willing to maintain it reputation by looking at it customers support activities and the service level agreement for timely assistance and updates. 2 I will also look at how well the SIEM platforms we want to choose integrates and is compatible with the Organizations existing infrastructure. 3 Then finally I will look at which option is able to perform task and meet the Organizations need and also grow with the Organization.

Seeing as you invested time and effort into requirements, hopefully thought went into how you worded them to easily turn each one into a vendor question. e.g. "Please provide an example of how your product does XYZ, provide documentation or examples of how this is achieved". Using a questionnaire like this is a good way to do a market evaluation of a number of key vendors. If you have a well-resourced procurement and IT security delivery function you could to this yourself, however in my experience using a consulting firm to help form the requirements, questionnaire, and engage with each vendor, then assess the responses and produce a report, then run a POC on the selected vendors to validate their responses can help a lot here.

One criterion that has a decisive influence on the price is the type of licence. The following options are available: Event-based with EPS (events per second), nodes with the number of systems and volume-based GB logs per day. This makes it difficult to compare the prices of different vendors. It is very hard to estimate upfront parameters like EPS or logs per day.

(1) Many Managed Security Service Providers (MSSPs) and Managed Detection and Response (MDR) providers offer a cost-effective and efficient option for organizations that lack the expertise or resources to manage their own SIEM. (2) If your IT stack is primarily composed of SaaS applications, you may be able to leverage the security features of existing tools like Cloud Access Security Brokers (CASBs) to perform some SIEM-like functions. While not a complete replacement for a dedicated SIEM, CASBs can provide log aggregation, basic threat detection, and compliance reporting. The decision of whether or not to buy a commercial SIEM should be based on a careful assessment of your organization's security needs, resources, and budget.

If you went down the path of using a 3rd party consultancy to help run this vendor assessment for SIEM and SOAR, ensure that the engagement includes POC on the top X vendors from the paper-based assessment. A scoring matrix approach should have been formed as part of the paper-based assessment, use this to compare the products/vendors, and select which to POC. The same scoring approach should be used for the POC test case analysis, and this will then allow a fair comparison of all the vendors. Your consultancy should form a report highlighting all the strengths and weaknesses of the products evaluated, and how many of your requirements were met. Use this data to help form your strategy to which product to precure.

Well after comparing my options and picking one,then comes the aspect of testing what the Organization has bought. I will do this through the following methods. 1 I will stimulate real world attack and threat scenarios to see how well the new SIEM platform is able to detect,alert and respond to this threats effectively. 2 I will also carry out a compliance testing to see how well the new platform meets relevant regulatory requirement that are relevant in the industry such as GDPR, HIPAA,ISO 27001 and NDPR... Finally I will test it performance and scalability under different workload to ensure it can handle increased data volume without compromising it performance.

Having been through a thorough paper-based assessment of market leading SIEM and SOAR products, run a POC where you ensure that the product actually meets your requirements, and now you have 2 reports highlighting the strengths and weaknesses of each vendor product. It's time to work with your leadership, finance and procurement teams to agree on which is the correct product to move forward with. Ensure that whichever product you choose will last for the length of the contract, will integrate with all your existing tools and processes, and meets your budget requirements. Don't forget to consider growth, for every new person or system you add more data will go into your SIEM, and it must grow with your company to be effective.

This very part is essential,since it is important to see how well the SIEM platform aligns with the Organizations goal for getting it in the first place. I will do this by carrying out a user feedback review on the platform from the security team and stakeholders involved in testing the SIEM tool. This i will do by considering their experience with such platforms, taking notes of the positive feedbacks and challenges faced while using the platform.

Implementing a SIEM is a journey. It will not be available with all rules immediately after purchase. Log sources need to be connected and systems need to be customised. It is therefore advisable to take a risk-based approach. Which systems pose the greatest risk and therefore need to be addressed first? A working CMDB would be also useful during the implementation of the SIEM and can also support the later operation. The CMDB helps to identify the systems, which needs to be monitored. In addition it helps to identify the response contact, if there is any issue with a specific system.

To select the ideal Security Information and Event Management (SIEM) platform, it is crucial to conduct a thorough evaluation. Begin by recognizing the needs of your organization, compliance obligations, and financial limitations. Assess features such as continuous monitoring, integration of threat intelligence, scalability, and user-friendly interfaces. Take into account the reputation of the vendor, their support services, and deployment choices. Give priority to platforms that match your security objectives, ensuring they provide customization, automation, and efficient log analysis. Lastly, carry out a trial period and gather input from security teams to make an informed decision.

Other things that can be considered is the kind of training and education put in place by the vendor,check if they offer comprehensive training that will help the team to efficiently maximize the SIEM platform. Also the ease of maintaining the platform and upgrading it should also be considered in getting a new SIEM platform.