Investigating with Data

Question 1

SIEM

Answer 1

Security Information and Event Monitoring

Question 2

What does a SIEM do?

Answer 2

Combination of different data sources into one tool that provides real-time analysis of security alerts generated by security applications and hardware

Question 3

Why are log reviews important?

Answer 3

Critical for security assurance and logs should be reviewed regularly and routinely, not just after an incident or as part of an instant responseS

Question 4

SIEM Functionality

Answer 4

Correlates and analyzes log data, consolidates data from various systems into a centralized database or repository, Consolidates data from various systems into a centeralized database or repository, Detects patterns indiciating security threats, and generates alerts for security teams to investigate

Question 5

Agent-Based vs. Agentless SIEM

Answer 5

Agent-Based and Agentless

Question 6

Agent-based

Answer 6

Software agents that are installed on each system to collect and send log data and it provides real-time data and detailed information

Question 7

Agentless

Answer 7

Log data is collected directly from systems using standard protocols and reduce maintenance but may not collect real-time or detailed data

Question 8

SIEM Implementations considerations

Answer 8

Log all relevant events and filter out irrelevant data, establish and document the scope of events, develop use cases to define threats, plan incident response actions for different events, establish a ticketing process to track flagged events, schedule regular threat hunting to detect unnoticed events, and provide auditors and analysts with an evidence trail

Question 9

Common SIEM Solutions

Answer 9

Splunk, ELK (Elastic Stack0. ArcSight, and QRadar

Question 10

Splunk

Answer 10

Big data information gathering and analysis tool, offers connectors for various data systems, and provides search processing language for data analysis

Question 11

ELK

Answer 11

Collection of free and open-source SIEM tools such as Elastic Search, Logstash, Kibana, and Beats

Question 12

ArcSight

Answer 12

SIEM log management and analytics software, suitable for compliance reporting for regulations like HIPAA, SOX, and PCI DSS

Question 13

QRadar

Answer 13

A SIEM log management, analytics, and compliance reporting platform created by IBM and it offers a dashboard for data visualization and analysis