Evaluating Security Information and Event Management: Eight Criteria for Choosing the Right SIEM Solution

Imagine if you had cuckoo clock, but instead of chiming at the top of the hour, it chimed after every minute. Not only would you be overwhelmed by noise, you’d also have a hard time figuring what time it was. This is increasingly the experience of IT Teams as they are inundated with syslog events, with no time to discern which alerts should take precedence over others.

Security Information and Event Management (SIEM) solutions can provide this streamlined analysis and prioritization that will allow your team to react quickly to the most aggressive threats. SIEM solutions provide valuable insights into potential security threats through a centralized collection and analysis of normalized security data pulled from a variety of systems.

But once you’ve made the choice to implement a SIEM into your security environment, how do you figure out which one to choose? SIEMs differ widely in terms of features, so it’s important to evaluate your own environment to determine what your priorities are. Consider the following eight criteria when looking at different options in order to find a solution that meets your specific needs.

1. Real-Time Monitoring and Alerting

Universally, this feature is a critical priority for all organizations. The ability to monitor and correlate threats in real time can be the difference between a minor hiccup and costly damage and disruption to your systems. Malicious actors and code move fast, so your security team needs to move just as quickly.

2. User Activity Monitoring

It’s easy to forget that oftentimes, the biggest danger to your system is within your own organizations. Whether it’s through malice or mistake, insider threats can cause even more disruption than an external actor, particularly when they are a privileged user with increased access. Monitoring all user activity can alert you to breaches and uncover misuse and errors. Additionally, privileged user monitoring is a requirement of many compliance regimes.

3. Use Case Investigations

Use your past to protect your future. Some SIEMs feature an open ecosystem that enable user configurations to support their unique use cases. Utilizing forensic data analysis can reduce risk by allowing you to focus in on the common use cases in your specific environment. These use cases can focus on both security projects, as well as non-security projects like IT operations.

4. Threat Detection Across the Environment

Organizations require a multitude of different technologies to operate. Your SIEM will need to be able to normalize and correlate all of these different data streams into a common format and give it meaning.  Ensure your SIEM can process Linux, Windows, databases, web services, applications, or equipment. This should not be limited to merely standard data sources, but every source within your organization’s environment. For maximum effectiveness, your SIEM should be able to easily integrate any customized feeds, from legacy applications to homegrown databases.

5. Long Term Event Storage

There’s no way around it: data takes up a lot of space. With logs constantly streaming data, you’ll need a SIEM with enough space to store it all. In order to do proper analysis, more data may need to be stored long term. Compliance may also require long term storage of data. Though storage is important, an effective solution should allow you to customize exactly what types of data you want to store, excluding data that you know is harmless.

6. Scalability

SIEM solutions should not only function for an organization in their current state but should also be able to scale with an organization in every way. For example, while organizations can plan for an expanding infrastructure, it’s nearly impossible to predict how much more data they will produce as they grow. Many SIEM solutions license by the amount of data processed, which is not only difficult to estimate, but may drastically and rapidly increase costs. Find a SIEM solution that licenses on a more predictable measurement, like device or data source, which can be planned for well in advance, preventing unpleasant surprises in licensing fees. Smaller organizations may even be able to get the coverage they need with a free SIEM like Event Manager, which provides full functionality for a limited amount of devices, and can easily scale up to the enterprise edition as an organization grows.

7. Integrations

 As your organization’s security suite expands, it can be easy to accidentally increase your IT Team’s workload by requiring them to juggle a glut of products that can’t talk to one another. Some SIEM solutions can pull in data from other enterprise applications, like antivirus software, login data, security auditing software, and more. The not only saves additional time, but also provides a holistic picture of your environment.

8. Reporting

IT operations and security teams alike are required to provide reports to both auditors and executives on a regular basis. Most organizations also need to comply with multiple regulations, which adds to the complexity and reporting effort. Your SIEM solution needs to be capable of delivering any of these contextually relevant reports to you and your management team.