Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Starting A SIEM Project from Vendor Use Case Content: WIN or FAIL?

By Anton Chuvakin
Historical Archive Note: This post was originally published on the Gartner Blog Network on December 2, 2015 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2015/12/02/starting-a-siem-project-from-vendor-use-case-content-win-or-fail/ | Archive.org Snapshot

Can I run my SIEM project exclusively with the use case content (including rules, reports, alerts, dashboards, algorithms) provided by my SIEM vendor?

Short answer: YES, as long as you START there, rather than FINISH there.

Longer answer: Indeed, many organizations have successfully implemented their monitoring capabilities (whether SIEM-centric or focused on other monitoring and security analytics tools) starting from canned content delivered with their SIEM or other tool. Better SIEM vendors spent 15+ years serving customers, even if for some of them they served primarily their compliance needs (a useful reminder: SIEM tech predates The Compliance Years of Infosec, which are roughly 2003-2008 in my estimation) and a lot of great content got developed. Some of it, BTW, is pretty “evergreen”; after all, a pattern of login failures followed by a successful login was relevant in 1999 and is relevant in 2015.

However, WIN happens if you start there, while FAIL [at least failure to realize full value of SIEM technology] happens when you assume that vendor content is all you ever need with SIEM. Most mature SIEM users report that their most valuable use cases were site-specific, custom or at least heavily customized. If “SIEM saved your bacon” too, think about those situations: was it canned vendor content that did it or something you put together in a coffee-fueled haze? 🙂

Now, think about these two EXTREME approaches to use case development:

  1. PRIORITY-CENTRIC: we will do first what is of TOP PRIORITY. This leads to people starting with, say, SAP logs and learning FAIL first-hand because it is so damn hard to start there. And then questioning SIEM value.
  2. FEASIBILITY-CENTRIC: we will do first what is EASY, does not require any changes to the tool, log sources etc. This leads to people solving problems they don’t really care to solve, and then questioning SIEM value.

One vendor recently told me the story of a customer who wanted to know the best use cases for SIEM if he has “only firewall logs and only two hours” (see also this classic post)…

If both extremes are bad, what works? This:

SIEM-prio-vs-feas

So, yes, START from vendor use case content, but DO rank them by means of your risk/threat assessment, compliance, etc – see this for details! Also, link the use cases you keep to your security operations processes, such as alert triage and/or, ultimately, incident response (IR). Decide which ones you will actually act on and keep (and refine) those. Next, as you learn the tool, move to juicier problems that require more content authoring. And, no, not all of them will need a SIEM – you may need UBA / UEBA, EDR / ETDR, etc. Ahem..even DLP… maybe.

Select recent blog posts related to SIEM: