What is SIEM?

Comprehensive log management

A SIEM solution ingests log data from sources across the network, including servers, firewalls, intrusion detection and prevention systems, applications, database servers, switches, routers, Active Directory servers, workstations, and more. This aggregated log data is stored securely in a central location, facilitating easy analysis. Log collection is usually carried out using various techniques, such as agentless and agent-based log collection.

Agent-based log collection

This method requires the deployment of an agent on every device. The agent collects logs, then parses and filters them before returning the logs to the SIEM server. This technique is mainly used in a closed and secured network, such as a demilitarized zone, where communication is restricted.

Agentless log collection

This is the more frequently used method in which logs generated by devices are automatically collected by the SIEM server using a secure communication channel, such as a specific port using secured protocols.

Followed by log collection, a SIEM tool parses the logs, extracting and normalizing the data to make them suitable for effective analysis and correlation.

Event correlation

The primary purpose of a SIEM solution, threat detection, is achieved by aggregating and correlating the security data. The correlation engine works on rules, which are sequences of events that could indicate a security threat. A modern-day SIEM solution uses non-event data and threat feeds to enrich its correlation engine's efficiency. SIEM solutions are customizable, offering users the ability to fine-tune the correlation rules to capture threats that are specific to the enterprise. Further, the correlation ability is tied to automated workflow executions, which reduces the manual process of addressing threats that require immediate intervention.

Traffic from a malicious source should be immediately blocked by writing a rule in the enterprise firewall. A SIEM solution should not only correlate the firewall logs with the threat feeds to detect the allowed malicious traffic, but also provide the option to immediately block the traffic by writing a firewall rule or policy. This process can be made more efficient by adding more context, such as a reputation feed of the malicious source.

Forensic analysis

With a SIEM solution, security analysts can securely retain log data for extended periods of time and comb through a vast number logs efficiently. This enables them to examine a security incident to determine the extent of data leakage, identify the perpetrator of the attack, see how long the attacker was in the environment, understand the series of actions taken by them, and assess the business impact. Furthermore, the forensic team can also reconstruct past security incidents to pinpoint any security vulnerabilities and prevent future cyberattacks.

Security incident management

A SIEM solution gathers all detected incidents and presents the timeline and critical data points in a dashboard to monitor, triage, and resolve them from a single console. While the real-time alerting systems of a SIEM solution helps reduce the mean time to detect (MTTD), the security incident management console helps to minimize the mean time to resolve (MTTR) by offering the ability to execute mitigation steps from within the console. The incident management capabilities of a SIEM tool also ensures accountability for security professionals by providing a dashboard to track and triage the incident resolution process.

Advanced threat analytics

The implementation of different threat detection mechanisms—rule-based correlation, signature-based threat detection, and ML-based anomaly detection—combined with real-time security alerts enhances the ability of a SIEM solution to accurately spot threats and reduce the MTTD. Security analytics provides a platform for effective threat investigation, which is further enhanced with threat feed integrations from reliable open-source tools or third-party vendors. Implementation of a threat modelling framework such as MITRE ATT&CK further strengthens the threat hunting, detection, analytics, and remediation capabilities of a SIEM solution. This speeds up the mitigation process by allowing admins to identify threat sources quickly.

UEBA

A SIEM tool's UEBA feature detects abnormal behavior in an organization network using ML and deep learning algorithms. A behavior baseline is created by collecting data related to user and entity activities in the network. When any deviation from the baseline is detected, a risk score will be assigned based on the severity. Deviations can include logons at an unusual hour, excessive logon failures within a short timeframe, privilege escalations, and more. Security administrators are notified in real time if the risk score crosses a set threshold. ML-driven UEBA captures advanced persistent threats that can often go undetected with rule-based detection mechanisms. UEBA also plays a major role in detecting insider threats, account compromises, and data exfiltration.