Defining Security Event Correlation

This my final post discussing security event correlation (SEC) for now. (When I say SAC I do not mean cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Simple Event Correlator [SEC] tool.)

Previously I looked at some history regarding SEC, showing that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 ways people thought about SEC really lacked rigor. Before describing my definition of SEC, I'd like to state what I think SEC is not. So, in my opinion -- you may disagree -- SEC is not:

1. Collection (of data sources): Simply putting all of your log sources in a central location is not correlation.


2. Normalization (of data sources): Converting your log sources into a common format, while perhaps necessary for correlation (according to some), is not correlation.


3. Prioritization (of events): Deciding what events you most care about is not correlation.


4. Suppression (via thresholding): Deciding not to see certain events is not correlation.


5. Accumulation (via simple incrementing counters: Some people consider a report that one has 100 messages of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 same type to be correlation. If that is really correlation I think your standards are too low. Counting is not correlation.


6. Centralization (of policies): Applying a single policy to multiple messages, while useful, is not correlation itself.


7. Summarization (via reports): Generating a report -- again helpful -- by itself is not correlation. It's counting and sorting.


8. Administration (of software): Configuring systems is definitely not correlation.


9. Delegation (of tasks): Telling someone to take action based on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 above data is not correlation.

So what is correlation? In my last post I cited Greg Shipley, who said if cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 engine sees A and also sees B or C, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n it will go do X. That seems closer to what I consider security event correlation. SEC has a content component (what happened) and a temporal component (when did it happen). Using those two elements you can accomplish what Greg says.

I'd like to offer cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 following definition, while being open to ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r ideas:

Security event correlation is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 process of applying criteria to data inputs, generally of a conditional ("if-cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n") nature, in order to generate actionable data outputs.

So what about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 nine elements are listed? They all seem important. Sure, but cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y are not correlation. They are functions of a Security Information and Event Management (SIEM) program, with correlation as one component. So, add correlation as item 10, and I think those 10 elements encompass SIEM well. This point is crucial:

SIEM is an operation, not a tool.

You can buy a SIEM tool but you can't buy a SIEM operation. You have to build a SIEM operation, and you may (or may not) use a SIEM to assist you.

Wait, didn't Raffy say SIM is dead? I'll try to respond to that soon. For now let me say that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 guiding principle for my own operation is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 following:

Not just more data; cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 right data -- fast, flexible, and functional.