- “Do I Know This Already?” Quiz
- Threat Hunting
- Vulnerability Scans
- Logs and Security Information and Event Management (SIEM)
- Security Orchestration, Automation, and Response (SOAR)
- Review Key Topics
- Define Key Terms
- Review Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
Logs and Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM) is a specialized device or software used for security monitoring; it collects, correlates, and helps security analysts analyze logs from multiple systems. SIEM typically allows for the following functions:
Log collection: This includes receiving information from devices with multiple protocols and formats, storing the logs, and providing historical reporting and log filtering. A log collector is software that is able to receive logs from multiple sources (data input) and in some cases offers storage capabilities and log analysis functionality.
Log normalization: This function extracts relevant attributes from logs received in different formats and stores them in a common data model or template. This allows for faster event classification and operations. Non-normalized logs are usually kept for archive, historical, and forensic purposes.
Log aggregation: This function aggregates information based on common information and reduces duplicates.
Log correlation: This is probably one of the most important SIEM functions. It refers to the capability of the system to associate events gathered by various systems, in different formats and at different times, and create a single actionable event for the security analyst or investigator. Often the quality of SIEM is related to the quality of its correlation engine.
Reporting: Event visibility is also a key functionality of SIEM. Reporting capabilities usually include real-time monitoring and historical base reports.
Most modern SIEMs also integrate with other information systems to gather additional contextual information to feed the correlation engine. For example, they can integrate with an identity management system to get contextual information about users or with NetFlow collectors to get additional flow-based information.
Several commercial SIEM systems are available. Here’s a list of some commercial SIEM solutions:
Micro Focus ArcSight
LogRhythm
IBM QRadar
Splunk
Figure 7-5 shows how SIEM can collect and process logs from routers, network switches, firewalls, intrusion detection, and other security products that may be in your infrastructure. It can also collect and process logs from applications, antivirus, antimalware, and other host-based security solutions.
Security operation center analysts and security engineers often collect packet captures during the investigation of a security incident. Packet captures provide the greatest detail about each transaction happening in the network. Full packet capture has been used for digital forensics for many years. However, most malware and attackers use encryption to be able to bypass and obfuscate their transactions. IP packet metadata can still be used to potentially detect an attack and determine the attacker’s tactics and techniques.
)
FIGURE 7-5 SIEM Collecting and Processing Logs from Disparate Systems
One of the drawbacks of collecting full packet captures in every corner of your network is the requirement for storage because packet captures in busy networks can take a significant amount of disk space. This is why numerous organizations often collect network metadata with NetFlow or IPFIX and store such data longer than when collecting packet captures.
Several sophisticated security tools also provide user behavior analysis mechanisms in order to potentially find insiders (internal attackers). Similarly, they provide insights of user behavior even if they do not present a security threat.
Organizations can also deploy sentiment analysis tools and solutions to help monitor customer sentiment and brand reputation. Often these tools can also reveal the intent and tone behind social media posts, as well as keep track of positive or negative opinions. Threat actors can also try to damage a company’s reputation by creating fake accounts and bots in social media platforms like Twitter, Facebook, or Instagram. Attackers can use these fake accounts and bots to provide negative public comments against the targeted organization.