Free - Gartner Guide to Deploying a SIEM

Get it here:

https://logrhythm.com/gartner-how-to-deploy-a-siem-successfully-analyst-report

SIEM is a Monster - How can you successfully deploy it? - Check this Gartner Article

You will need to provide some basic details before you can download it.



https://logrhythm.com/gartner-how-to-deploy-a-siem-successfully-analyst-report/

what is SOAR? - Security Orchestration, Automation and Response

Another buzzword to sell new products but, will they really do anything useful?
Probably so, here is an interesting essay from Bruce on the "Orchestration" and "incident response" to understand it better

Data does not equal information, and information does not equal understanding



Data does not equal information, and information does not equal understanding

Uncertainty demands initiative, while certainty demands synchronization

When things are uncertain, you want your systems to be decentralized. When things are certain, centralization is more important. Good incident response teams know that decentralization goes hand in hand with initiative.


Automation has its place. If you think about the product categories where it has worked, they’re all areas where we have pretty strong certainty. Automation works in antivirus, firewalls, patch management and authentication systems

For More info:
https://securityintelligence.com/security-orchestration-for-an-uncertain-world/

(SIEM) Monitoring - Where do we start (or restart).

Most vendors would like to add a lot of devices to your SIEM, display a lot of alerts and reports and vanish. In simple term your SIEM becomes GIGO (Garbage In Garbage Out)


Here is a sensible check list from Dr. Anton Chuvakin which can be a good starting point.



Follow this link:-
http://www.securitywarriorconsulting.com/security-incident-log-review-checklist.html

6 Questions for SIEM vendor - From AlienVault

The SIEM as we know has evolved so, I found the following questions from AlienVault presentation as something that is short and sweet.


From the Article:

==========================

1. How long from installation to security insight?
2. Integration work measured in years, months or hours?
3. Do you simply integrate data from security tools (SIEM), or embed tools and orchestrate into effective incident response workflows (USM)? e.g. asset inventories. IDS. vulnerability scans. netfls, etc.
4. What is the real TCO - licensing, consulting, implementation and maintenance/tuning fees?
5. A list of alarms or step-by-step instructions on how to confirm, respond and mitigate threats?
6. Is there a community for threat sharing? If so, how large, broad and open?

==========================

#1 and #2 are related to the my 3I (Installation, Implementation, Integration). ( it will still fail if there is no Planning AND commitment from all stakeholders)

#3 can get value from existing data sources

#4 is where we are turned in to fools by Vendors.

#5 is where Target failed ( Incident Response Failure).

#6 The answer normally is "YES" but, the reality could be different

The Full Presentation is available at the link below:

http://info.alienvault.com/181JTR1210000tU000qZf00

HOW-TO:- For SIEM folks - Sending Symantec DLP logs to a SIEM in SysLog format

Thought this might be useful for some

http://www.symantec.com/connect/articles/configure-symantec-dlp-rsa-envison-syslog-alert