Somebody asked me that question “Do I need SIEM or do I need log management?” yesterday again, and I figured I’d repost this “bit of Anton’s wisdom” (ego alert!
), so that people can just read this instead of repeatedly bugging me with this question.
Q: How do I figure out whether I need SIEM or log management?
A: You need log management – if you have computers, IT, data, etc. Period! This is not really a discussion item at all, since about 1986 or so. But do you also need a SIEM? You might think you need it, but you would only be able to benefit from it and satisfy that need if your organization fits the following "graduation criteria from log management to SIEM:”
- Response capability: The organization must be ready to respond to alerts soon after they are produced. Incident response process/procedures are a must
- Monitoring capability: The organization must have or start to a build security monitoring capability such as a Security Operations Center (SOC), or at least a team/person/resource dedicated to ongoing periodic monitoring.
- Tuning and customization capability: The organization must accept responsibility for tuning and customizing the deployed SIEM tool; pure out-of-the-box SIEM deployments rarely succeed.
(originally written for this paper where the above are clarified in more detail)
Possibly related posts:
- All my posts about SIEM
