What is SIEM Security

SIEM (Security Information and Event Management) systems are the cornerstone of most security processes in modern Security Operations Centers (SOCs). A SIEM saves security analysts the effort of monitoring a variety of disparate systems and putting together large amounts of log data to create a coherent image.

SIEM security is about integrating SIEM with security tools, network monitoring tools, performance monitoring tools, critical servers and endpoints, and other IT systems. SIEMs also ingest and analyze log and event data to generate alerts on activities identified as potential security incidents.

SIEMs and their capabilities

Security Information and Event Management (SIEM) solutions are tools you can use to centralize alerting, logging and compliance. SIEM tools can correlate the data they collect to reveal the context of alerts and events across multiple systems.

SIEM tools collect and aggregate logs, reports and alerts from any security tool or security solution. Then present this information in a centralized location. This improves visibility and speeds up incident analysis and response.

SIEM solutions work according to a three-step cycle.

• Data collection: Collect data logs from devices, applications, systems and existing security tools.
• Data integration: SIEM solutions normalize and categorize this data for analysis. Classifications include who the user is, what credentials they used, what systems they accessed, and what processes they ran.
• Data Analysis: Analyze classified data and compare against rules (definition of acceptable behavior). Alert your security team when an event is deemed suspicious.

Evolution of SIEM Security

Analysts point to three generations of SIEM security capabilities and technologies.

• The first generation SIEM was introduced in 2005 to integrate previously separate log and event management systems. However, they were limited in the amount of data they could process and the sophistication of the alerts and visualizations they could generate.
• Second-generation SIEMs have improved capabilities for handling big data, or large amounts of log history. This generation of SIEMs has been able to correlate historical log data with real-time events and data from threat intelligence feeds.
• The third generation SIEM is a concept proposed by Gartner in 2017 that combines traditional SIEM capabilities with two new technologies. The first is UEBA (User and Entity Behavior Analytics). This feature uses machine learning to define criteria for user and IT system behavior and identify anomalies. Next is SOAR (Security Orchestration, Automation, and Response). This feature helps analysts quickly analyze incidents and enables security tools to automatically respond to incidents.

Over the past two decades, SIEMs have proven themselves to be a powerful and effective infrastructure for security teams. But it also comes with a harsh reputation: expensive, difficult to implement and use, and difficult to scale. As a result, SIEMs were initially only considered by large, well-skilled security companies.

A new generation of SIEM addresses the aforementioned challenges by being easier to deploy and use, requiring less compute resources and leveraging lower cost storage. SIEM security solutions are also offered as a service in the cloud, with various deployment options offered by MSSPs (Managed Security Service Providers) that balance cost and ease of implementation.

Importance of SIEM

Businesses use SIEM technology to:

• Log management and retention
• Continuous security monitoring and incident response
• case management
• Policy enforcement and response to violations
• Compliance with government requirements such as HIPAA, PII, NERC, SOX, COBIT 5, PCI, FISMA

In addition to these purposes, why is the existence of a SIEM important? Personnel receiving security breaches want to be prepared with an answer when asked to explain what happened.

Many companies also implement SIEMs to protect sensitive data while preserving evidence of the protection process. A failed audit can have devastating consequences, including employee termination, loss of business, and hefty fines.

SIEM value

Correlating security events

A SIEM aggregates and analyzes all the data from log management functions looking for signs of threat intrusion or data compromise. For example, login failures are generally not a concern. However, a single user's failed logins on multiple applications across the IT environment may indicate a threat. The relationships between data in each application can only be understood through the capabilities of SIEM.

threat intelligence

Among the SIEM's capabilities is the connection to threat intelligence feeds. This includes feeds from third parties and solution providers. Each independent feed typically holds its own threat data. Leveraging information from many feeds ensures optimal use of the solution.

security alert

Your SIEM should keep your security team up-to-date on potential threats via dashboard updates, text alerts, email alerts, and more. Without up-to-date information, your security team may miss threats and allow them to reside on your servers.

The value of next-generation SIEM solutions

SIEM is now an established technology, but next-generation SIEMs have new capabilities:

UEBA (User and Entity Behavior Analytics): Modern SIEMs go beyond correlation, leveraging machine learning and AI techniques to identify and explore normal and abnormal human behavior. . This insight allows companies to uncover malicious activity, insider fraud and impersonation.

Security Orchestration, Automation, and Response (SOAR): Next-generation SIEMs come with automated incident response systems. For example, it can identify ransomware alerts and, in response, automatically perform containment steps before hackers encrypt data on affected systems.

UEBA in modern SIEM security

UEBA (User and Entity Behavior Analysis) is an emerging area of security solutions that can identify behavioral criteria and uncover anomalous behavior that could indicate a security incident. UEBA can detect security incidents that tools that rely on pre-defined patterns and static correlation rules can't find. Third-generation SIEM solutions have UEBA capabilities built-in.

Common use cases for SIEMs incorporating UEBA technology include:

• Malicious insider: When a user account holder with privileged access to an IT system misuses the account for their own gain. Insider attacks can be devastating and invisible to most security tools. UEBA allows you to define baselines for each user's behavior and detect suspicious events that may indicate malicious intent.
• Compromised Insider: When an attacker gains control of a user account to reconnoiter, plan an attack, or conduct an actual attack on an organization's systems. UEBA can identify unusual user behavior and alert security personnel.
• Prioritization of Incidents and Alerts (Alert Triage): Alert fatigue is a problem because SIEM security alerts place a heavy burden on security analysts. UEBA can ease the burden of prioritizing alerts. To do this, UEBA combines alerts and signals from many tools, ranks alerts and incidents according to the amount of anomalous behavior (risk score), and layers a layer of contextual data about the organization (services accessing sensitive data). and user accounts).
• Data Loss Prevention (DLP): DLP tools such as traditional SIEM generate a large number of alerts for all anomalous events related to an organization's sensitive data. UEBA tools can prioritize and refine DLP alerts by calculating a risk score using data from multiple tools to indicate events that represent anomalous behavior. UEBA also allows DLP alerts to be placed on the incident timeline. This helps in incident verification and investigation.

SOAR in modern SIEM security

Security Orchestration, Automation, and Response (SOAR) systems, another emerging technology embedded in third-generation SIEM solutions,have the following key capabilities:

• Orchestration: SOAR's integration with other security solutions enables these solutions to capture data and act proactively. For example, you can investigate whether an email sender has a bad reputation by using DNS tools to see where the message came from.
• Automation: Users can define security playbooks using SOAR. This is a response manual that codes the workflow for security operations. When a known type of security incident occurs, playbooks can be enabled to automatically take mitigation actions. For example, it can scan files identified as malware and perform destructive actions in the Box.
• Incident management and collaboration: When a SIEM generates a security alert, the SIEM's SOAR component adds contextual information and evidence to help analysts investigate the problem, and organizes this information into an incident timeline for easy understanding. I can. Analysts can also collaborate with each other to add additional insights and data they discover during research.

SIEM software evaluation

We recommend the following stages when evaluating a SIEM solution:

SIEM implementation best practices

Example of next-gen SIEM with UEBA and SOAR embedded

Exabeamis a 3rd generation SIEM platform that is easy to implement and easy to use. It comes with advanced features according to the revised Gartner SIEM model.

• Advanced Analytics and Forensics: Threat identification with behavioral analysis based on machine learning, identification of suspicious individuals with dynamic grouping of peers and entities, lateral movement detection.
• Data exploration, reporting and retention: Flat rate, unlimited log data retention leveraging the latest data lake technology. Context-aware log analysis helps security analysts quickly find the data they need.
• Threat Hunting: A mouse-driven threat hunting interface enables analysts to proactively search and discover threats. Build rules and queries using natural language without SQL or NLP (Natural Language Processing).
• Incident Response and SOC Automation: A centralized approach to incident response allows you to collect data from hundreds of different tools and orchestrate responses into different types of incidents via security playbooks. Exabeam can automate investigation, containment and mitigation workflows.

Figure 2: Exabeam malware playbook

ORION CASSETTO
Exabeam, Inc. Director, Product Marketing