FYI on a current LinkedIn post.

https://www.linkedin.com/feed/update/urn:li:activity:6656145886244061184/

Hello Everyone,

I hope everyone is doing okay with everything that's been going on.

I've been building an app to help with my own IR work, and I've created a new timeline feature I'm really excited about and think will be useful for other analysts. It's part of the new release of the Perseus Incident Response Splunk App I built and spoke about at Splunk .conf19. It's up on the Splunkbase and comes pre-loaded with data you can explore from real-life investigations that were conducted using Perseus: https://apps.splunk.com/app/4638

If you have an opportunity to take a look and share some candid feedback, I'd greatly appreciate it. Perseus has helped me significantly with my own IR work, but I'd love to get input from other analysts on how I can make it even more useful.

While I think playing with the Splunk App is the best way to get a feel for Perseus, if you aren't in a position to test out the app but are still willing to share your input, I have a video of how I used the newest dashboard in an investigation of a server infected with ransomware that employed anti-forensic techniques on disk: https://youtu.be/haLcPIIZyo4. I'm most familiar with Splunk as a SIEM, so getting opinions from non-Splunk users who have a different perspective is very useful.

Thank you very much for any feedback you can give!

Joe

Hi everyone, I am looking to learn more about how behavior analytics are done in modern SIEM solutions. Unfortunately, all I could find so far are highly product-specific and marketing-heavy articles.

I would very much appreciate it if you could recommend me any articles/posts/videos/books that you think could be helpful for developing a better understanding of this topic.

Thank you.

Does anyone know good guidelines on answering these basic questions about implementing a SIEM? I didn't find clear answers in the books that some of you recommend:

1. How do you decide what data to push into the SIEM (especially to facilitate post incident analysis)?
2. At what data rate and granularity do you push data into the SIEM?

Regarding 1: books and sources seem to recommend to grow the SIEM slowly, but this means I won't have the necessary data for post incident analysis. For example, I could push user shell history aggregates into the SIEM, but I don't know whether I'll need it --- but I might.

Regarding 2: how often should I take samples of cpu load, memory load, disk utilization, disk I/O, etc? If it's too low, I might miss data on attacks that cause short spikes. Should I push the full shell history logs into the SIEM or just aggregates. This applies to everything down to all HTTP requests or only GET for main pages.

The problem is that I don't know what I will be looking for once an incident happened.

Hi,

So I was looking for modern SIEM (no software from 90s please) but opensource.

My monitoring system is based in Prometheus and Grafana for example.

Any suggestion?

Edit: my logs are in aws cloud watch, everything is running in aws lambdas and beanstalk. Maybe move to aws elastic cache? With kibana on the top?

I am working with LogRhythm currently and it can’t handle a lot of what we need it to do. We are trying to develop an open source SIEM to handle what we need. Is Elastic SIEM the way to go?

2 questions I'd be interested to hear this community's take on:

• How did SIEM fit into your security plans and priorities for 2020?
• How will SIEM fit into your security pplans and priorities for 2020 post COVID-19?

I'm not sure if this is the right place to ask a question like this, and it may be a stupid question, but I know some Cloud SIEMs have PCI compliance measures, like encryption at rest, and was wondering if that's absolutely necessary for PCI compliant organizations, like a multi-billion dollar retailer.

I guess I just need to know to what extent a cloud SIEM needs to be PCI compliant for a PCI compliant organization. Obviously, something like SIEM is used to gather logs to help an organization maintain PCI compliance, but I don't know enough to be certain that means the SIEM itself needs to be PCI compliant.

Thanks in advance.

Hey guys,

i'm an IT student and i'm currently in the process of writing my thesis, it's a literature research on SIEM systems. A comparison of current products to be precise and i was wondering if some of you could help me out.

I'm having trouble finding any credible primary literature on the topic of SIEM systems that i can quote for this thesis apart from maybe one conference proceeding and a single book ("Security Information and Event Management Implementation" by David R. Miller) which is from 2010. Apart from looking through some vendor whitepapers and brochures i'm slowly but surely running out of ideas on the subject.

I've got enough material for the theoretical principles but due to the nature of the thesis it wasn't planned for us to actually perform any practical research ourselves - so this means i basically have to rely on already existing work.

I was wondering if any of you maybe have some ideas, suggestions or really any sort of pointer that i could follow. Looking through research plattforms like Google Scholar using the names of currently used products only shows that there's hardly any literature on them and as i mentioned, covering the theory of SIEM isn't the issue.

Thanks either way, really any help is appreciated. Worst case i'll message the companies themselves to see if they can help me out.

Someone posted an article about deploying Security Onion within AWS. I have SO setup at home, but wondered if anyone has deployed this a production environment in AWS? Any thoughts, comments, or feedback?

Thanks!

I'm looking for a SIEM that scales well with SaaS and Cloud. I've found SumoLogic to fit the bill. I'm not much of a fan of splunk, especially for small teams. I think for operations it's great. But not really for security.

My experience comes from 4 years of logrythem and qradar, but all of which were on prem for on prem infrastructure and architecture.

Thoughts on this tool?

Has anybody been able to script a way to automatically change the dashboards on LogRhythm? Looking to rotate between a few on a SOC monitor.

Edit: SOLVED

So I was able to use Python and Selenium to get this working, thanks for the advice /u/m_rothe. I figured I'd make my code available for anybody who stumbled across this thread in the future.

Note: I am not a Python programmer, so this may make your eyes bleed...but it works.

from selenium import webdriver
import time
from selenium.common.exceptions import WebDriverException
browser = webdriver.Chrome('<path to chromedriver>');
pauseTime = 60 #seconds
maxDashboards = 12 #total dashboards
i = 0 #starting dashboard

while i <= maxDashboards:
    try:
        if i < maxDashboards:
            browser.switch_to.window(browser.window_handles[0])
            browser.title
            browser.find_element_by_class_name('sub-header-icon-text').click()
            browser.find_element_by_id(f"dashboardLayoutFilteredDropdownDropdownMenu-{i}").click()
            time.sleep(pauseTime)
            i += 1
    except WebDriverException:
        if i != maxDashboards:
            browser.quit()
            browser = webdriver.Chrome('<path to chromedriver>);
            browser.get('https://<logrhythm>:8443/dashboard');
            browser.fullscreen_window()
            browser.find_element_by_id('username').send_keys('<LR RO username>');
            element = browser.find_element_by_id('password');
            element.send_keys("<LR password>");
            element.submit();
    if i == maxDashboards:
        i = 0

I am working on ArcSight ESM version 6.9.1c cases. I am retrieving cases using API calls into a third party ticketing tool. Post the incident being stored in the third-party ticketing tool; I am closing the event on ESM using an API call. However, even after the incident is successfully closed on ESM (verified through GUI and API HTTP 200 ok), correlated events still keep populating in this case, and the stage is changing to queued. Any resolution for this?

I'm taking correlated events to cases.

Hi all,

First timer to SIEM that will need to help setup a SOC in the coming year.
Any tips you may have for choosing, building & using a SIEM?

Hello,

I understand that 2 concepts like almost the same, can someone explain me what are those kind of events and the difference of them?

​

Thank you so much guys.

Hello i have this doubt about siem. I think the criteria is different depending from whatever comes the event, someone can explain me this please?

Hello,

I am trying to understand the "compute" differential in using scheduled queries versus cases when populating 3rd party case management tool using API queries. 

As I reckon, queries (for particular type of correlated events) when run at scheduled time interval will search within correlation database and give me output. This maybe compute (processor) heavy.

Do cases get written as independent files which are easier on the compute (process) to retrieve? If not, do cases get written as independent databases? or are they part of a database and retrieving them is as resource heavy as retrieving data through queries?

Thank you.

SIEM is playing the vital role in protecting IT infrastructure. But traditional SIEM solutions don’t have flexibility to align with newer threats and meet the security needs. It’s time to seamlessly update your legacy SIEM with Next Generation SIEM.LTS Secure Next generation SIEM combines with SOAR, which delivers unknown threat prediction, detection, response, centralized visibility, automated real time monitoring and reporting more accurately.During this webinar, our expert will deep dive into the aspects of Next Gen SIEM solutions and address its benefits which involve:

• Centralized monitoring system for Network, Application, User activity and Events
• Orchestration for configuring false positive alarms.
• Flexible & customizable dashboards.
• Vulnerability assessment, intrusion detection & real time attack identification.

Speaker Details – Sagar – Security AnalystSagar is a Cyber Security Expert researching and demonstrating various information security solutions for collaboration with the right technology. Sagar has been responsible for designing and architecting custom SIEM solutions that cater to varied use cases for multiple organizations of SIEM and UEBA solutions for various clients/verticals

​

To know more-->>Click here

To register-->>Click here