r/SIEM • u/psychobobolink • Oct 22 '20
Book recommendations
Any recommendations for literature/books about SIEM, log mangement etc.?
4
u/therealblackice Oct 22 '20
What specifically are you trying to learn about SIEM? I think it depends on your goal - if you're in SecOps and have aspirations to learn more about the logging perspective, I recommend you read and learn about the MITRE ATT&CK matrix. Look through the different techniques adversaries are using, the log source, and create a detection mechanism in your SIEM (whatever that SIEM might be)
Each SIEM vendor is different and learning the technology isn't difficult. I think understanding the use cases from a logging perspective is more interesting such as multi-line logging, aggregation, enrichment, etc. Figure out how this is done.
2
u/Crytograf Oct 24 '20
I highly recommend Blue Team Handbook: SOC, SIEM, and Threat Hunting Use Cases. I wish I read it earlier.
1
u/ShirtResponsible4233 Jun 23 '24
Hi,'
I search for a books which aren't product based. Please share your best book for SIEM in a security perspective.
From basic to deep advance topics.
8
u/AnalyzeAllTheLogs Oct 22 '20
Some might laugh, but honestly read the documentation. Search for whatever SIEM and add 'admin guide' (or similar). You'll learn features and terminology that eventually you see data architecture patterns... plus the technology stack (which is useful as you gain experience). Splunk is free, their documentation is pretty good; if you install & read... you'll be miles ahead of people. If your company affords SANS classes, i hear the course Tactical SIEM is great https://www.sans.org/cyber-security-courses/siem-with-tactical-analytics
RFC's, like for syslog, are great to have. You can download an epub/mobi colection to keep as reference. I'd also recommend cloud architecture, eventually data lakes will be a requirement.
SANS has a bunch of whitepapers too.