15 Ways To Get More Value From Security Log And Event Data

[Excerpted from "15 Ways to Get More Value From Security Log and Event Data," a new report posted this week on Dark Reading's Security Monitoring Tech Center.]

Data is both a blessing and a curse for organizations today. The enormous amounts of log data generated by enterprise networks, servers, personal computing devices, and applications can be mined and analyzed to identify and even prevent threats to security, not to mention drive purposeful, strategic technology and business decisions. But all that data presents a huge challenge: In this sea of data, we often don’t know what’s important.

In other words, we are drowning in data but are thirsty for actionable information. There’s a growing push to solve this issue.

Trouble is, there is no universal attack detection “secret sauce,” nor a simple button you can push to help extract more value from your log files. In reality, the tasks that SIEM -- or security information and event management -- and log management tools are designed to help automate are complicated, and the scope of systems and data they are required to monitor makes detecting attacks and failures like finding the proverbial needle in a haystack.

In general, getting more out of your organization’s log and event data is really about doing more with what you already have. There is no dearth of tools for monitoring and analyzing the data generated by the dozens -- if not hundreds -- of IT systems in any organization. However, the resources and expertise to take full advantage of these tools can be elusive.

So how do you successfully mine, analyze, and apply information from log and event systems?