2021 SIEM Magic Quadrant Flashcards
What were the key findings from the SIEM MQ?
Most security information and event management (SIEM) solutions are complex
technologies that require subject matter expertise and adequate resources to aid in
the evaluation, selection, implementation and ongoing operation.
■
The interest in cloud SIEM is growing with Gartner clients, with vendors introducing
offerings to meet increased demand. However, cloud-based SIEM is not universally
available, and different styles exist.
■
Although advanced analytics that use machine learning are becoming a common
component of most SIEM solutions, packaging and licensing variations still exist.
■
Security orchestration, automation and response (SOAR) solutions are increasingly
available (as a premium add-on) from SIEM vendors to complement their SIEM
solutions.
■
What does Gartner recommend for IT security and risk management leaders responsible for security operations?
Identify and document security use cases to drive the requirements and required
capabilities for a SIEM solution.
■
Decide whether cloud SIEM over an on-premises or hybrid deployment is appropriate
for their organization.
■
Plan to evolve their SIEM strategy by enabling or adding on other solutions, like
UEBA and SOAR. This will be necessary to mature your SOC and security operations
capabilities
What percentage of SIEM vendors offer a cloud-native and delivered “as-a-service” version of their solution today? What is Gartner’s expectation in 2024?
40%, 80%
What is a SIEM? What are the greatest challenges SIEM vendors try to address?
SIEM solutions are complex technologies as they centralize a variety of capabilities,
functions and features into a single platform to aid a user in detecting unexpected
activities and events in their environments. These could include external and internal
threats, noncompliance with policies and regulations, and supporting the investigation of
and reaction to these events.
SIEM solution vendors continue to address the demands from SIEM buyers that cause the
greatest challenges with deploying, managing and operating these solutions.
Identify and document security use cases to drive the requirements and required
capabilities for a SIEM solution.
What is the highest possible product score for an Essential SIEM Use Case? What is the lowest possible score?
5, 0
What is the highest possible product score for an Complex SIEM Use Case? What is the lowest possible score?
5, 0
What is the highest possible product score for supporting a Modern SOC Use Case? What is the lowest possible score?
5, 0
