Configuring your SIEM Flashcards
SIEM solutions can be implemented as software, hardware appliances, or
outsourced managed services
▪ Log all relevant events and filter irrelevant data
▪ Establish and document scope of events
▪ Develop use cases to define a threat
▪ Plan incident response to an event
▪ Establish a ticketing process to track events
▪ Schedule regular threat hunting
▪ Provide auditors and analysts an evidence trail
SIEM
A market-leading big data information gathering and analysis tool that can import
machine-generated data via a connector or visibility add-on
Splunk
Collection of free and open-source SIEM tools that provides storage, search, and
analysis functions
▪ Elasticsearch (query/analytics)
▪ Logstash (log collection/normalization)
▪ Kibana (visualization)
▪ Beats (endpoint collection agents)
ELK/Elastic Stack
A SIEM log management and analytics software that can be used for compliance
reporting for legislation and regulations like HIPPA, SOX, and PCI DSS
ArcSight
A SIEM log management, analytics, and compliance reporting platform created by
IBM
QRadar
A SIEM solution originally developed by Alien Vault, now owned by AT&T, and
rebranded as AT&T Cybersecurity
Alien Vault and OSSIM (Open-Source Security Information Management)
An open-source SIEM with an enterprise version focused on compliance and
supporting IT operations and DevOps
Graylog
Security data comes from numerous sources across the organization so it comes
in different formats
Data Normalization
Process where data is reformatted or restructured to facilitate the scanning and
analysis process
Normalization
An agent service is installed on each host to log, filter, aggregate, and
normalize data on the host before sending it to the SIEM server for
analysis and storage
Agent-based
Hosts are configured to push updates to the SEIM server using a
protocol like syslog or SNMP
Listener/Collector
A SIEM can collect packet capture and traffic flow data from sniffers
and sensors positions across the network
Sensors
Logs created by the operating system on each client or server to record how users
and software interact with the system
Event Log
Logs created by the operating system on each client or server to record how users
and software interact with the system
Application
Security
System
Setup
Forwarded Events
There are four categories of severity inside the Windows event logs
Information
Warning
Error
Audit Success/Failure
