On Broken SIEM Deployments

Imagine you own a broken, dilapidated, failing SIEM crap deployment. What? Really… that, like, never happens, dude! SIEM is what makes unicorns shine and be happy all cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 time, right?

Well…mmm… no comment. In this post, I want to address one common  #FAIL scenario: a SIEM that is failing because it was deployed with a goal of real-time security monitoring, all cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 while cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 company was nowhere near ready (not mature enough) to have any monitoring process and operations (criteria for it).  On my log/SIEM maturity scale (presented here, also see this related post from Raffy), cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y are eicá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 ignorance phase or maybe log collection phase.

And herein lies cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 problem: if you deployed one of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 legacy, born in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 1990s SIEMs that are not based on a solid log management platform, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 tool will actually suck at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 very fundamental level: log collection. The specific issue here is that most of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se early tools were designed to only selectively collect what was deemed necessary for real-time security monitoring (vs all log data). In essence, you have a tool with monitoring features (that you don’t use) and with weak collection features (that you can use, but cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y are weak).

What to do? You have cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se options:

1. Leave it to rot; you can always keep it just to boast to your friends (and PCI QSAs) that “ye own one of ‘em olde SIEMs”
2. Blow it away and join cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 “SIEM doesn’t work” crowd – and maybe buy a simple log management tool later
3. Deploy a log management tool to “undergird” your crappy SIEM; you have a choice of buying from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same SIEM vendor (if cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y have it) or a different vendor
4. Built your own log management layer on syslog and open source tools

I have seen people take eicá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 above four. Personally, I have seen much more success with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 option #3 (buy log management) and not infrequently with #4 (built log management) – BTW, this deck might help you choose. You want to move your SIEM setup from “get some logs – ignore all logs” model to “collect all/more logs – review some logs” which is typically much more aligned with your level of maturity. And cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n grow and solve more problems with your SIEM and demonstrate “quick wins.” While you are at it, review some architecture choices discussed here.

Enjoy …while it lasts.

Possibly related posts on SIEM:

• Top 10 Criteria for a SIEM?
• Algorithmic SIEM "Correlation" Is Back?
• How Do I Get The Best SIEM?
• Log Management->SIEM Graduation Criteria: Violate at Your Own Peril!
• How to Replace a SIEM?
• SIEM Resourcing or How Much cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Friggin’ Thing Would REALLY Cost Me?
• How to Write an OK SIEM RFP?
• On Choosing SIEM
• "So, What Should I Want?" or How NOT to Pick a SIEM-III?
• The Myth of SIEM as "An Analyst-in-cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365-box" or How NOT to Pick a SIEM-II?
• I Want to Buy Correlation” or How NOT to Pick a SIEM?
• Log Management + SIEM = ?
• On SIEM Complexity
• SIEM Bloggables: SIEM Use Cases and Whitepaper with detailed SIEM use cases
• Log Management / SIEM Users: "Minimalist" vs "Analyst"
• All posts labeled SIEM