Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Fun Challenges with SIEM Use Cases

By Anton Chuvakin
Historical Archive Note: This post was originally published on the Gartner Blog Network on November 11, 2015 by Anton Chuvakin.
Original URL: https://blogs.gartner.com/anton-chuvakin/2015/11/11/fun-challenges-with-siem-use-cases | Archive.org Snapshot

Often I save the solutions for our Gartner GTP papers, but I blog about the challenges. No, this won’t be a post [eh…. a short trilogy of no more than 3000 pages?] on all the ways of SIEM FAIL (look here for this), the idea here is to focus on use case-related troubles and problems with SIEM and security monitoring.

  1. Canned or vendor-imposed SIEM use cases only — this essentially means that you are using the power of SIEM with one (well, maybe both?) hands tied behind your back. It will work, for sure, but it is most likely that the value won’t be maximized for you.
  2. No consistent mechanism for “converting” vague problems into precise SIEM use case — basically, a broken use case discovery process means you will solve only easy and specific problems (like “see if anybody connects to our payment card database at night”)
  3. Driving use case from available data alone — an input-driven SIEM (as opposed to “output-driven”) may work, with some luck, but overall we see more value and more happiness with an output-driven SIEM approach.
  4. Hero-driven use cases — while not truly problematic, this just does not pass the legendary “bus test”; if only one person owns all SIEM usage, and nobody else has a clue, what happens if this sole hero is hit by a bus – or ?
  5. Overly burdensome use case process — sure, some of us like “SIEM content as code” model, but this does not mean that a change to a correlation rule should take 3 weeks and 11 gates in the project….

What are YOUR SIEM use case challenges?!

Select recent blog posts related to SIEM: