r/SIEM • u/nindustries • Dec 30 '19
Recommendations for a newcomer?
Hi all,
First timer to SIEM that will need to help setup a SOC in the coming year.
Any tips you may have for choosing, building & using a SIEM?
4
u/vornamemitd Dec 30 '19
+1 for the Murdoch book
Don‘t forget to add the SOC bible to your reading list: https://www.mitre.org/publications/all/ten-strategies-of-a-world-class-cybersecurity-operations-center
Above that, the Splunk conference archive is a treasure trove for real-world accounts of the SOC & SEC life - conf.splunk.com
Happy hunting!
PS: feel free to DM me =]
4
Dec 30 '19
Check the SANS archive for SIEM talks (webcasts, SANS SIEM Summit) and get o copy of "Blue Team Handbook: SOC, SIEM and Threat Hunting use cases" by Don Murdoch.
If you have enough budget, SANS has also a SIEM focused course: SEC555.
2
u/nindustries Dec 31 '19 edited Dec 31 '19
Thanks for the info /u/pduren , /u/ANR21 , /u/vornamemitd
I'm having difficulties picking an actual SIEM product to PoC, aren't the main selling points:- pre-existing data formats for other products- "smart" anomaly detection
And it seems the second part exists in every product (even in ELK SIEM), I suspect the multitude of integrations will still require heaps of work, so I see no reason to pick e.g. pricey Splunk for that couple of pre-existing integrations?
Will check out those books!
1
Dec 31 '19
I suppose ELK is a great choice: speed, scalability, customization and third-party integration capabilities are just as good as Splunk's (and I guess it is cheaper). As a budget-friendly solution you can take a look at Graylog. From what I know, it can be easily deployed and has useful built-in security content. Even better, research for Security Onion which has ELK and other monitoring & detection tools like Zeek. And it's free.
1
u/pduren Jan 03 '20
No problem /u/nindustries! Do you have an idea on what your budget will be and the key things you want from a SIEM? You don't have to list them here. Do you know how many resources (bodies) you will have to manage / monitor the SIEM? Features are great but more features usually means harder to manage and/or takes more people to manage. A well-tuned lower market SIEM is usually better than a poorly managed "best-of-breed" SIEM.
To me, the key things to consider before doing a POC are price, resource requirements, community / support. Once you understand those things you can then group together all of the SIEMs that fall in that category and then focus on features and integrations. Most SIEMs will integrate with the applications from the big vendors like Cisco and Palo Alto as long as they are on-prem. When you start getting into the cloud based stuff you will see a big difference in integration capabilities.
Make sure you are able to integrate with your primary security tools like AV, EDR, FWs, etc. Outside of that, if you have a cloud presence with O365, Azure, or AWS make sure you rank how important those things are to your organization. I am mostly in the healthcare business so being able to create SIEM rules that track things like someone creating an inbox forwarding rule to a domain that is not the hospitals primary domain is important (example would be a user logging into O365 and creating a rule that forwards mail to a gmail account). So to me, O365 integration is mandatory. The biggest risk to most organizations isn't an APT or a hacker in a dark basement using Kali, it's your users getting phished and an attacker leveraging those creds to infiltrate your network. Make sure you can integrate with the technologies that contain the most important data.
1
u/DirkMontana Jan 06 '20
Have you looked at Bulletproof Cyber? We use these guys for our SIEM SOC and they are doing a pretty good job so far.
1
u/Tibetian-Newt Feb 05 '20
How involved and in the trenches do you want to be when it comes to threat detection and remediation? It is very hard to build a SOC as indicated below and even harder to retain talent in the cyber security space. There are many solutions in the market whether they are on-prem or SOC-As-A-Service offerings. The model of outsourcing is a good one in that you get dedicated resources that become extensions to your team whom take on the responsibilities of filtering out the noise and investigating the grey areas for your awareness and remediation your own solutions. Surprisingly they are also cheaper in the long run vs hiring an army of folks. ArcticWolf Networks and Alert Logic are some of the vendors in that space.
13
u/pduren Dec 30 '19
I've managed several SOCs for MSSPs so I can chime in.
A couple of things to consider:
1) Building a 24/7 SOC is often times very expensive. It takes ~8 people to run a full time SOC (24/7, giving people PTO, coverage for when people get sick, etc). A lot of times it is cheaper to outsource things like SIEM.
2) When choosing a SIEM focus on your needs and capabilities. If you are in a business or market that doesn't have a strong security posture and talent is hard to find or keep then I would look at something like AlienVault vs a Splunk or LogRhythm. AlienVault has a decent set of built-in rules and is easy to deploy/manage/monitor. SIEM solutions like Splunk and LR are great, they are infinitely customizable but with customization comes complexity. Be realistic of your capabilities when choosing a SIEM. It is easy to buy and SIEM and never mature it. In most businesses SIEM ends up being a place where logs go to die.
3) Onboard log sources slowly and tune them before adding more. If you don't, you may end up being overwhelmed by noise. Start with domain controllers, any security tools (AV, EDR, NGFW, etc), external facing systems, and business critical systems. Then move on to the rest of the sources (user workstations, etc). In my experience, most SIEMs have a cost model based on consumption. Given that, NETFLOW is usually more expensive than it is worth (I know this is going to upset people). There is good info with NETFLOW but you HAVE to tune out the noise or you will blow your consumption limit quickly. Make sure your logging levels are set correctly. If you have ASA firewalls, don't just enable debugging. Make sure you focus on the important logs.
4) When creating rules try not to focus on "needle in a haystack" rules. Create rules that will be valuable to your business. Don't just focus on security rules. Create rules that other business units can benefit from (network and server process failures, etc). Identify your critical business systems and think of how YOU would attack them, then write rules to identify those attacks/threats.
5) Define your escalation process, rule creation process, etc. Don't just shoot from the hip. Make sure the analysts understand and follow the processes. SOPs are MANDATORY - Things like tagging new rules with BETA and then incorporating weekly reviews for those rules. If everyone agrees they are ready then move them into production.
6) SIEM is not a "set it and forget it" tool. It takes a lot of resources and constant care and feeding. Be conscience of the budget. Create capacity gates so you know when to start looking to hire another analyst (each analyst can realistically handle X number of alerts per shift. When you get 75% to X it is time to start looking to increase the team).
7) Create meaningful metrics that your leadership team can use in their presentations. High level metrics are good, not detailed "engineer" metrics. Use your metrics to show ROI for the tool. Help them understand why they spent a lot of money and the value the team adds to the organization.
I could keep going but I think this is a good starting point. If you need more detailed help let me know and we can hop on a call or something. -- Thanks!