SIEM - GlobeSoft Qatar

What is SIEM?

A SIEM – standing for Security Information and Event Management. Is a major IT tool with the objective of managing security events generated by information systems. SIEM solution allows your organization to finally make sense out of logs from different types of equipment in the IT. Additionally, SIEM is meant to detect cyber attacks and IT threats. By exploiting and filtering different logs coming from several information sources (that could be internal or external).

SIEM as Security Information and Event Management:

SIEM is a centralized and powerful supervision system that traditionally included two parts:

A SIM (Security Incident Management) dealing with post analysis, storage, archival, compliance, reporting. But also with internal threats linked to logging management delivering reports and detailed analysis. An SEM (Security Event Management) collecting and handling real-time data to analyze logs coming from IT systems, networks and applications. It allows IT event management. Event correlation is the ultimate tool to counterattack incidents and internal or external threats.

To be 100% efficient, organizational, human and legal aspects have to be taken into consideration when deploying SIEM software. And that often goes overlooked. As every organization is different regarding security maturity, security threat, and internal operational capabilities. A SIEM needs the adequate processes behind it to gives all its potential.

Features of a SIEM:

What can SIEM do?

Event standardization: storing raw data logs for legal purposes and saving them in a proper format that can be easily exploitable.

Event storage and archival according to the nature of an event.

Reporting and analysis: generating dashboards and reports to have full visibility of IT security and IS compliance.

The objectives of a SIEM deployment

Detect cyberattacks by maintaining permanent surveillance of organizational IS.

Compliance management.

Counterattack incidents and generate forensic type analysis (digital investigation).

Improve storage and archival systems.

Detect abnormal or suspicious users’ behaviors, website servers, applications,and networks.

Generate operational security dashboards for IT managers and central management.

Choosing The Right SIEM:

SIEM can handle a very high number of data, but sometimes it does not have to be like that. There is a misconception that event sources should send everything to the SIEM, and it will take care of it. Without a well-balanced log level or if the monitored traffic is to wide, the SIEM and the operational processes behind it will quickly show their limits. Thus, choosing an appropriate SIEM solution starts from the threats, attack scenarios, and compliance environment. They will tell which data is interesting to collect, its process and how long it should be kept.