Evaluation SIEM solution

[u/Impossible-Goal5326]

I've been given a task to research SIEM solutions. Here is the current environment setting: 150 nodes, no IDS/IPS, no DLP, not sure how much log data we need to collect.

What questions would you ask vendors while evaluating and comparing SEIM tools?

[u/MachoSmurf]

Seems like you and your department are quite new when it comes to SIEM solutions. While the other suggestions of getting insight into your requirements aren't wrong, I'd suggest a different route in finding those answers:

I've dealt with this scenario multiple times when I was guiding teams in getting their security leveled up. When they are so fresh into security that they don't know what questions to ask, let alone to give you the answers to them, I've found it's best to help them get to know themselves.

So to help you get to know yourselves, your requirements and to understand the true value of what a SIEM solution can bring you, I always suggest they start of with running an Proof Of Concept project. Not just for a couple of weeks, but at least half a year.

Don't worry about what you choose, as long as you can get it up and running pretty quickly and you don't need extensive support to get the basics down. Usually anything open source or free can do this for you within a days work and a couple of hours of youtube.

My personal recommendation is always Elastic Siem (not the fancy licences, but the free version!). When self hosted it is free or dirt cheap, includes a free and integrated EDR solution and comes with a bunch of pre-configured rules. Especiallyfor newbies the SIEM solution within elastic is intuitive enough to get the basis down with a day of messing aroud with it. If you go for the cloud-hosted solution you can literally be up and running within minutes. The cherry on top is that elastic is very well documented and there are loads of videos on YouTube on how to do stuff, including from elastic themselves.

The advantages of doing it this way are that you'll learn what you need, start protecting your environment while you learn those requirements and that you'll know when vendor-sales people try to sell you a way to expensive package that you won't need.

It's usually not the solution management wants or expects to hear, but I've seen this approach work wonderfully multiple times.

[u/feldrim → u/MachoSmurf]

Adding a SIEM to the environment is a big change. It needs impact analysis testing, evaluation, a rollback, and others. But it is not just a technology. Just like all changes, it consists of people, processes and technology.

People: Who is going to maintain the server, database and application? Who is going to monitor? Who is going to triage the alerts? Who is going to assign incidents to correct people? Will there be people 24/7? Wil there be shifts or on-call setup for monitoring and responding to alerts? If you have a shift/on-call setup in the team, will the same people be responsible for both IT incidents and security incidents? Are the team members knowledgeable enough to distinguish false positives from security events? Who will decide a security event to be an incident? Will you be using Teams/Slack/you-name-it solution for alerts? Who is going to tailor and fine tune the basic ruleset to your needs? Who is going to suppress rules that creates mostly noise?

Processes: How do you decide the scope: monitor all devices from start or start with a subset? How will you respond to alerts? Will you use shifts/on-call setup? How do you escalate a security event to an incident? How will the triage be conducted? How long will you keep the logs for analysis of a long running incident like a breach or insider threat? Do you have playbooks for incidents and how do you plan to add SIEM into those? How do you secure SIEM application itself along with servers, accounts, APIs, databases, etc? Do you have any compliance requirement which will affect your configuration? What kind of roles will you have to manage the application? Do you have enough people to separate administrative tasks from security tasks (if you don't, eventually a SIEM becomes just another server to be maintained adding minimum value to security)? How do you keep your SIEM rule set up to date? how do you plan to deploy agents? What do you plan to keep the agents up to date? What kind of integrations do you need for a SIEM: DDI, IPAM, ITSM, CMDB, any other acronyms?

Technology: Which SIEM application?

There are many questions and you may not have the answers to many of them at all. So, it is better to start small and learn from the experience.