Section 23.222 Security Information and Event Management (SIEM)

Question 1

SIEM (Security Information and Event Management)

Answer 1

A solution for real-time or near-real-time analysis of security alerts generated by network hardware and applications

■ SIEM helps correlate various events and incidents from system logs

Question 2

Importance of Log Reviews

Answer 2

Critical for security assurance

■ Logs should be reviewed regularly and routinely, not just after an incident or as part of an instant response

Question 3

SIEM Functionality

Answer 3

■ Correlates and analyses log data

■ Consolidates data from various systems into a centralized database or repository

■ Detects patterns indicating security threats

■ Generates alerts for security teams to investigate

Question 4

Agent-Based vs. Agentless SIEM

Agent-Based

Answer 4

● Software agents are installed on each system to collect and send log data

● Provides real-time data and detailed information

Question 5

Agent-Based vs. Agentless SIEM

Agentless

Answer 5

● Log data is collected directly from systems using standard protocols

● Reduces maintenance but may not collect real-time or detailed data

Question 6

SIEM Implementation Considerations

Answer 6

■ Log all relevant events and filter out irrelevant data

■ Establish and document the scope of events

■ Develop use cases to define threats

■ Plan incident response actions for different events

■ Establish a ticketing process to track flagged events

■ Schedule regular threat hunting to detect unnoticed events

■ Provide auditors and analysts with an evidence trail

Question 7

Common SIEM Solutions

Splunk

Answer 7

● Big data information gathering and analysis tool

● Offers connectors for various data systems

● Provides search processing language for data analysis

● Comes with pre-configured templates and dashboards

Question 8

Common SIEM Solutions

ELK (Elastic Stack)

Answer 8

A collection of free and open-source SIEM tools, including the following

○ Elasticsearch
○ Logstash
○ Kibana
○ Beats

Components work together for log collection, storage, analysis, and visualisation

Question 9

Common SIEM Solutions

ArcSight

Answer 9

SIEM log management and analytics software

● Suitable for compliance reporting for regulations like HIPAA, SOX, and PCI DSS

Question 10

Common SIEM Solutions

QRadar

Answer 10

● A SIEM log management, analytics, and compliance reporting platform created by IBM

● Offers a dashboard for data visualisation and analysis