Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Why SIEMs F*cked Up Application Log Analysis?

By Anton Chuvakin
Historical Archive Note: This post was originally published on the Gartner Blog Network on January 13, 2017 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2017/01/13/why-siems-fcked-up-application-log-analysis/ | Archive.org Snapshot

This is going to be a short one: why do you think the SIEM vendors f*cked up application log analysis so badly?

Think about it, SIEM technology started roughly in 1997, so 20 years ago. 20 years is like 2 gazillion years in “IT years.” But even today I see a lot of people who equate SIEM with “IT infrastructure monitoring” (i.e. routers, servers, security appliances) or, worse, think that “SIEM is a network security technology.” I’ve long fought this view, but I essentially lost this battle …

So, now, I am sitting here listening to UEBA / UBA clients gush about how great their UEBA is with application log analysis and application security monitoring. They bring up all sorts of esoteric applications (machine parts management, medical research support, financial transaction processing, etc) and then wax poetic about how great their UEBA tool is for revealing insights from the log data and how it saved them so much dough, despite the fact that they paid $1,000,000 for their UEBA.

Why is that? What do UEBA tools know that SIEMs miss?

If you think, “but wait, UEBA has ML and magic AI stuff”, think again. Well, it does, but some of the use cases are very rule-based and do not extend beyond the “IF <this> AND <that> THEN <whatever>” correlations.

So, what is to blame here? Perhaps, some of these …

  • SIEM historical association with IT infrastructure, not business application, monitoring
  • Lack of schema support for business application log data
  • The very requirement to shove the data into a standard schema
  • Obvious lack of out-of-the-box content (rules, alerts, dashboards, etc) for custom application security monitoring
  • Heavy role of identity and entitlement data in application monitoring
  • Requirements for inclusion of non-IT data in analysis
  • Or even … customers never pushing SIEM vendors to “do applications”?

… or even something completely different. All in all, it feels like the SIEM guys blew this one as well… and now need to catch up with the UEBAs.

Related blog posts about security analytics: