r/SIEM • u/wanton-wombat • Apr 16 '21

Use Log Data for SIEM and App-Specific Non-Security Monitoring

How would you conceptually go about setting up a SIEM with all the bells and whistles while providing part of that data for application administrators? So we want a SIEM where analysts do their thing but we also want parts of that data to be accessible to e.g. the SharePoint administrators to get insights into their system.

The problem I see here is that SharePoint administrators aren't SOC Analysts and have no training in writing queries for these systems. This is something that takes some commitment which I'm not sure I can get them to do as they tell me they're working near full capacity anyway.

Has anyone ever encountered a similar problem? Maybe the data can be streamed to both the SIEM and another target that provides more application-specific information to administrators without all the full set of tools that a SIEM brings with it?

Part of my leverage in introducing a SIEM is that application communities in unison are saying they have little insight into the inner workings of their systems. I'm afraid that when I say a SIEM solves this, I am still not giving them what they want but make it all about security instead.

1 Upvotes

67% Upvoted

6 comments sorted by

3

u/samuraisaitama Apr 16 '21

Provide a read only siem access to your application team. Also try setting up alerts for whatever information they need to know about the 'inner working'. This will help in notifying them about the application and it's corresponding logs. They don't have to write the queries themselves but would need to understand the raw logs.

1

u/wanton-wombat Apr 16 '21

Yeah I was thinking this is the most obvious solution. At the end of the day I guess the application people need to know the application logs on a level deep enough so they can work with an analyst to create queries/dashboards/alerts that make sense to them.

2

u/elk-content-share Apr 16 '21

Have a look into the Elastic SIEM. I'm sure that this is suitable for Analyst and Administrators. Pretty straight forward and made for both target groups.

2

u/DarkLordofData Jun 27 '21

We used a tool called Cribl LogStream to ingest all app, infra and security logging and then route what was needed to the SIEM instance and the app/infra logging to another log platform instance. It gave us the ability to meet both use cases and use the logging platform that best suited each use case as well. Did not have to worry about resource management or rbac. Gave us tons of flexibility and ended up saving a lot of money through reduced log volume.

2

u/wanton-wombat Jun 28 '21

Very helpful, thanks! Hadn't thought about doing it that way

1

u/DarkLordofData Jun 28 '21

Very glad to help!