Services of SIEM
"In this video, I will discuss the security services offered by Security Information and Event Management (SIEM) solutions.
These services include log centralization, log normalization, and alerts.
All endpoints, servers, workstations, network devices, applications, cloud services, and security tools generate local logs. This log data is overwhelming to manually search or analyze. Therefore, we use a SIEM solution. All these devices are configured to forward a copy of their local logs to a central repository of the SIEM solution.
In certain systems where this feature is not supported, you may need to install a software agent to collect local logs and forward them to the SIEM solution. At the SIEM system, the integrity of this log data is protected because local system admins or network admins cannot delete centrally stored logs on the SIEM solution, as they do not have access to it. The SIEM solution is managed and administered by a separate Security Administrator role. However, a local administrator can reconfigure their respective assets to stop forwarding local log copies to the SIEM solution.
Now, in log normalization, different devices use different log formats. These formats are converted into a standard format. For example, some systems may use user IDs while others use usernames for the same type of information. This standardization and labeling facilitate the SIEM solution to search and correlate log data across different log sources, such as different endpoints.
In correlation and analysis, the SIEM builds relationships among offensive activities based on log data received from various sources. At the SIEM solution, signatures of abnormal activities across different log sources are developed. Furthermore, enrichment can add additional context from external intelligence applications, cloud applications, or cyber threat intelligence platforms. These external applications provide context on abnormal activities to the SIEM solution, turning this information into actionable intelligence.
The final service is alerting. In correlation and analysis, different correlation rules are built. When these rules are triggered by an offense, the Security Administrator of the SIEM solution sees these offenses on the SIEM console. This represents automated continuous monitoring by the SIEM solution.
Additionally, some SIEM solutions offer the ability to investigate and initiate incident responses against these alerts. This includes tracking investigation efforts, such as which analysts are working on a particular alert, the incident response steps being taken, and the artifacts collected related to an offense. However, this service is often part of a separate solution, such as a Security Orchestration, Automation, and Response (SOAR) platform.
Thank you."