In the field of computer security, security information and event management (SIEM) software products and services combine security information management (SIM) and security event management (SEM). They provide real-time analysis of security alerts generated by applications and network hardware

1. Security Information and Event
Management

11. Incident Investigations & ManagementDashboards and Reports
Statistical Outliers
Asset and Identity Aware

12. What is a Security Operations Center (SOC)?
PRIMARY GOAL: Reduce risk via improved security
SECONDARY GOALS: Compliance, anti-DDOS attack, fraud detection
Centralized location(s) where key IT systems
of an organization are monitored, assessed
and defended from cyber attacks.
Security
Operations
Center

14. Architecture of SOC
Device
Management
Threat and
Vulnerability
Management
Incident
Response
Level 1
Level 2
Security Operators
Security
Analysts
Software
Engineers
Incident
Handlers
Security Information and Event Management
(SIEM)
Hardware
Software
People
Procedure
Security and Network Devices

15. TIER
1
• Monitoring
• Opens tickets, closes false positives
• Basic investigation and mitigation
TIER
2
• Deep investigations/CSIRT
• Mitigation/recommends changes
TIER
3+
• Advanced investigations/CSIRT
• Prevention
• Threat hunting
• Forensics
• Counter-intelligence
• Malware reverser
15
(MINIMIZE INCIDENTS
REACHING THEM)
ALERTS FROM:
• Security Intelligence
Platform
• Help Desk
• Other IT Depts.
Simplified SOC Tiers

17. Need of Security Intelligence Platform (SIEM + more!)

18. Benefits of Security Intelligence Platform
SIEM Security Intelligence Platform
Data Sources to Index Limited Any technology, device
Add Intelligence & Context Difficult Easy
Speed & Scalability Slow and limited scale Fast and horizontal scale
Search, Reporting, Analytics Difficult and rigid Easy and flexible
Anomaly/Outlier Detection
and Risk Scoring
Limited Flexible
Open Platform Closed Open with API and SDKs

19. Security Intelligence Platform Enables Many Security
Use Cases
SECURITY &
COMPLIANCE
REPORTING
REAL-TIME
MONITORING OF
KNOWN THREATS
DETECTING
UNKNOWN
THREATS
INCIDENT
INVESTIGATIONS
& FORENSICS
FRAUD
DETECTION
INSIDER
THREAT
Security Intelligence Platform

20. Conclusion
SIEM products and services provides centralized security logging and
reporting for organizations to detect, analysis and mitigation of security
incidents.
Organizations considering the acquisition of a SIEM product should
carefully consider its deployment and management costs & there may
be considerable integration costs in facilitating that transfer and
translation of log data.
SIEM management costs are usually underestimated, and like many
technologies, organization gets value out of a SIEM comparable to the
effort that the organization puts into its configuration, monitoring and
other management aspects.

21. Thank You