Lecture 4 pt. 1 Flashcards
What does SIEM stand for?
Security Information and Event Management
SIEM is a solution that collects and analyzes security data from across an organization.
What is log data?
A digital record of events occurring within a system, application, or network device
Log data can include user activity, system performance, and security events.
What are the types of log data (6)?
- Application logs
- System logs
- Security logs
- Network log data
- Audit logs
- Database log data
What is the purpose of application logs?
To track user activities, identify errors, and monitor performance metrics
What do security logs help to identify?
Potential threats and ensure timely responses to attempted security breaches
What is the function of network log data?
To monitor and control traffic flows within a network
What do audit logs document?
Various events as part of an audit or compliance control process
What critical role do database log data play?
- Maintaining data integrity
- Enabling recovery in case of system failure
- Optimizing database performance
What are the (5) main characteristics of Log Management Systems (LMS)?
- Log data collection
- Data retention
- Log indexing
- Reporting
- Searching capabilities
What are key limitations of LMS compared to SIEM (3)?
LMS does not typically offer analysis, alerting, and incident response capabilities
What do SIEM systems provide that LMS do not?
- Real-time threat analysis
- Automated alerting
- Threat notifications
How does SIEM enhance log data?
By converting logs into a uniform format and organizing them into categories
What is the role of machine learning in Next-Gen SIEM systems?
To draw connections between seemingly unrelated events that might indicate a security breach
What are the key functions of SIEM systems?
- Visibility/Log Collection
- Consolidation
- Aggregation
- Organization/Normalization
- Correlation
- Alerts
- Prioritization
- Reporting
- Compliance
What is a use case in the context of SIEM?
Technical rules or conditions applied on logs ingested into the SIEM
What should be done with use cases in SIEM?
- Have a clear list of use cases
- Map them to the Mitre Att&ck phases
- Assign clear priority based on the organization
Fill in the blank: SIEM tools send alerts whenever a potential _______ is detected.
security threat
True or False: Log management provides analysis of log data.
False
