SIEM Use Cases And Other Security Monitoring Use Cases Too

Historical Archive Note: This post was originally published on the Gartner Blog Network on October 27, 2015 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2015/10/27/siem-use-cases-and-other-security-monitoring-use-cases-too/ | Archive.org Snapshot

This post discusses SIEM Use Cases And Other Security Monitoring Use Cases Too, addressing enterprise architecture considerations and operational guidance based on our ongoing research inquiries on the Gartner Blog Network.

In analyzing security operations, detection telemetry, and incident handling workflows, practitioners must carefully balance organizational design, process maturity, and technology automation.

Key takeaways and recommendations:

• Define explicit operational use cases before committing to technology tooling.
• Ensure telemetry normalization and detection engineering feedback loops are established.
• Foster close collaboration between monitoring, detection engineering, and incident response teams.

Related blogs:

• Cloud Security Monitoring!
• Two Essential SIEM Notes