A security, incident and event management system collects, centralizes and analyzes data from across the IT environment to uncover cybersecurity and operational problems.
As with so many formerly distinct and well-defined cybersecurity systems, "SIEM" is now as often a set of features as it is a separate product or service. In the current era of category drift and tool convergence, an extended detection and response (XDR) platform might include SIEM features, a SIEM offering might include user and entity behavior analytics (UEBA) and so on.
Whether in a standalone product or as part of a broader offering, enterprises continue to rely on SIEM functionality. Top SIEM use cases span cybersecurity and IT ops and include log management, attack detection, event detection, event forensics and cybersecurity posture management.
1. Log management
This is job No. 1 for a SIEM. In addition to serving as the destination for logs from core security systems such as firewalls and intrusion detection and protection systems, SIEMs also aggregate and normalize streams from more far-flung data sources, such as endpoint detection and response and XDR systems. A centralized repository for security event log data is useful for monitoring, analysis and compliance purposes.
SIEMs gather operational logging data -- e.g. performance data on a router's interfaces -- as well as cybersecurity logs, so they are useful to the NOC and IT ops staff as well as to the SOC.
2. Attack detection
While SIEMs can do a lot to detect attacks on their own, they benefit from integration with UEBA systems. UEBAs are specifically built to apply advanced behavioral analytics to the kinds of real-time activity data that a SIEM provides.
Note that a SIEM typically does not coordinate the response to an attack. That responsibility traditionally falls to a security orchestration, automation and response system, which can also integrate with the SIEM.
3. Event detection
Not all events are attacks. Equipment failures and performance problems can lead to events that show up in logs, and a SIEM can alert IT ops staff and the network operations (NOC) team when such issues occur. For example, when a router stops reporting normal traffic from a branch office, the SIEM might alert the NOC to the problem.
4. Forensics and root cause analysis
SIEMs are repositories of huge volumes of data relevant to attacks -- whether successful or averted -- and provide search and filter features to help investigators tease out relevant information and patterns. Similarly, IT ops teams searching for root causes of problems in WANs, campus networks or data centers can benefit from these capabilities.
5. Cybersecurity posture management -- i.e., breach prevention
SIEM offers a view not just into performance and alert data but also device configurations, making it useful in monitoring for policy deviations and supporting cybersecurity posture management. SIEMs can see and report when running configurations differ from documented ones, whether because of an insider attack or normal configuration drift from ad-hoc changes made in the course of problem solving.
John Burke is CTO and a research analyst at Nemertes Research. Burke joined Nemertes in 2005 with nearly two decades of technology experience. He has worked at all levels of IT, including as an end-user support specialist, programmer, system administrator, database specialist, network administrator, network architect and systems architect.
