Every organization should have a security information and event management (SIEM) system, says Parker, whether you use a managed service or run everything in-house. The most important part in maximizing the value of a SIEM system is developing the necessary custom content. "The value of the data going into there is key," he adds.
Your environment will be unique from all other environments using the same SIEM tool, Parker explains. While buying a SIEM is a good first step, the return on your investment will only be recognized if you architect it well and create the right content for it. This means having a strong architect or team to develop custom content and gain visibility into endpoints and cloud environments. Many companies deploy a SIEM and have limited visibility because they only look at endpoint detection or firewall logs, says Parker. As a result, the value they gain is disproportionate to the amount spent on their system.
John Pironti, president at IP Architects, also points to the importance of keeping the SIEM updated with relevant content to maximize value. "The problem with SIEM is SIEM gets stale," he explains. If you want to get the most out of your SIEM, you need to stay attuned to business logic, evolving activity, and changes in operational models, programs, and applications. Adversaries are changing tactics, and security teams need to stay updated with their monitoring and SIEM systems to be aware of threats on the horizon.
(Image: Sashkin via Shutterstock)