Security information and event management
Security information and event management is a subsection within the field of computer security, where software products and services combine security information management and security event management. They provide real-time analysis of security alerts generated by applications and network hardware.
Vendors sell SIEM as software, as appliances, or as managed services; these products are also used to log security data and generate reports for compliance purposes.
The term and the initialism SIEM was coined by Mark Nicolett and Amrit Williams of Gartner in 2005.
Overview
The acronyms SEM, SIM and SIEM have sometimes been used interchangeably, but generally refer to the different primary focus of products:- Log management: Focus on simple collection and storage of log messages and audit trails
- Security information management : Long-term storage as well as analysis and reporting of log data.
- Security event manager : Real-time monitoring, correlation of events, notifications and console views.
- Security information and event management : Combines SIM and SEM and provides real-time analysis of security alerts generated by network hardware and applications.
- Managed Security Service: or Managed Security Service Provider: : The most common managed services appear to evolve around connectivity and bandwidth, network monitoring, security, virtualization, and disaster recovery.
- Security as a service : These security services often include authentication, anti-virus, anti-malware/spyware, intrusion detection, Penetration testing and security event management, among others.
A key focus is to monitor and help manage user and service privileges, directory services and other system-configuration changes; as well as providing log auditing and review and incident response.
As with many meanings and definitions of capabilities, evolving requirements continually shape derivatives of SIEM product-categories. The need for voice-centric visibility or vSIEM provides a recent example of this evolution.
SIEM vendors include: Arcsight, , IBM, LogRhythm, Splunk and others.
Capabilities/components
- Data aggregation: Log management aggregates data from many sources, including network, security, servers, databases, applications, providing the ability to consolidate monitored data to help avoid missing crucial events.
- Correlation: Looks for common attributes, and links events together into meaningful bundles. This technology provides the ability to perform a variety of correlation techniques to integrate different sources, in order to turn data into useful information. Correlation is typically a function of the Security Event Management portion of a full SIEM solution. can be aided by automation technologies such as Artificial Intelligence and Natural Language Processing, to lower the burden on the security analysts.
- Alerting: The automated analysis of correlated events
- Dashboards: Tools can take event data and turn it into informational charts to assist in seeing patterns, or identifying activity that is not forming a standard pattern.
- Compliance: Applications can be employed to automate the gathering of compliance data, producing reports that adapt to existing security, governance and auditing processes.
- Retention: Employing long-term storage of historical data to facilitate correlation of data over time, and to provide the retention necessary for compliance requirements. Long term log data retention is critical in forensic investigations as it is unlikely that discovery of a network breach will be at the time of the breach occurring.
- Forensic analysis: The ability to search across logs on different nodes and time periods based on specific criteria. This mitigates having to aggregate log information in your head or having to search through thousands and thousands of logs.
Use cases
- SIEM visibility and anomaly detection could help detect zero-days or polymorphic code. Primarily due to low rates of anti-virus detection against this type of rapidly changing malware.
- Parsing, log normalization and categorization can occur automatically, regardless of the type of computer or network device, as long as it can send a log.
- Visualization with a SIEM using security events and log failures can aid in pattern detection.
- Protocol anomalies which can indicate a mis-configuration or a security issue can be identified with a SIEM using pattern detection, alerting, baseline and dashboards.
- SIEMS can detect covert, malicious communications and encrypted channels.
- Cyberwarfare can be detected by SIEMs with accuracy, discovering both attackers and victims.
Alerting examples
| Rule | Goal | Trigger | Event Sources |
| Repeat Attack-Login Source | Early warning for brute force attacks, password guessing, and misconfigured applications. | Alert on 3 or more failed logins in 1 minute from a single host. | Active Directory, Syslog, RADIUS, TACACS, Monitored Applications. |
| Repeat Attack-Firewall | Early warning for scans, worm propagation, etc. | Alert on 15 or more Firewall Drop/Reject/Deny Events from a single IP Address in one minute. | Firewalls, Routers and Switches. |
| Repeat Attack-Network Intrusion Prevention System | Early warning for scans, worm propagation, etc. | Alert on 7 or more IDS Alerts from a single IP Address in one minute | Network Intrusion Detection and Prevention Devices |
| Repeat Attack-Host Intrusion Prevention System | Find hosts that may be infected or compromised | Alert on 3 or more events from a single IP Address in 10 minutes | Host Intrusion Prevention System Alerts |
| Virus Detection/Removal | Alert when a virus, spyware or other malware is detected on a host | Alert when a single host sees an identifiable piece of malware | Anti-Virus, HIPS, Network/System Behavioral Anomaly Detectors |
| Virus or Spyware Detected but Failed to Clean | Alert when >1 Hour has passed since malware was detected, on a source, with no corresponding virus successfully removed | Alert when a single host fails to auto-clean malware within 1 hour of detection | Firewall, NIPS, Anti-Virus, HIPS, Failed Login Events |