What is a SIEM?

Today, virtually everything can be done online: video chatting with people thousands of miles away, buying anything from fresh home cooking to your next car, and even working from anywhere. Though the pros of the internet seem limitless, several flaws require our attention. With the number of connected devices multiplying year after year paired with the increased volume and complexity of the traffic, organizations have difficulty identifying who connects to their network. Security Information and Event Management (SIEM) platforms are common tools to help organizations identify users and devices that log into their network, detect suspicious behaviors, and identify potential security threats.

Why is a SIEM important?

To stay competitive, organizations must expand their networks and keep up with trends, such as working from anywhere and cloud computing. This shift makes them more vulnerable to cyberattacks and data breaches. SIEM platforms work as aggregators of records of events that occurred in the network (commonly known as logs). They compile log data from multiple sources, normalize the information gathered, and use analytics to discover trends and uncover any suspicious activity detected. Given that SIEM platforms are a key component in a threat detection and response strategy, organizations allocate resources (either internal or external) to 24/7 monitor security events detected and manage alerts.

What does a SIEM do?

The list of capabilities for SIEM technologies could vary by provider. The most relevant ones are:

• Real-time monitoring of the network, users, data, and applications to visualize events as they occur and minimize risks of undesired guests penetrating and dwelling in networks without being noticed.
• Profile behavior of users and devices that converge in the network. SIEM platforms can understand typical behaviors and identify if something is suspicious, like users logging in the wee hours, lots of files downloaded in a short time, and multiple unsuccessful logging attempts by the same device.
• Manage logs and sources used. SIEM platforms can work with multiple data streams with different schemas and fields. They organize fields and records or “normalize” them to make the information easy to analyze and correlate.
• Use the gathered data and information to prepare analytics and present a holistic view of the organization’s security landscape.
• Finally, organizations need SIEM platforms for compliance requirements for frameworks such as HIPAA, PCI, SOX, and GDPR.

What challenges might I run into with SIEM?

As with any other tool, SIEM technologies only work effectively if they are managed effectively. Some of the main challenges organizations face while working with SIEM platforms are:

• Deployment: Once organizations select the platform that fits their needs and buy licenses, the next step is SIEM deployment. Businesses struggle to set up SIEM appropriately; some organizations need years to achieve an optimal stage.
• Log ingest: Garbage in, garbage out. If the SIEM environment uses incorrect data or omits log sources, all the analytics and alerts produced by the platform will lack quality, resulting in security noise and false negatives keeping the security teams busy on inefficient work.
• Use cases: Use cases are the rules implemented in the SIEM platform to monitor and analyze the logs ingested into the environment. Organizations must have their use cases regularly updated and tuned to keep up with the latest threats and expect better results from their platform.

How Can Lumen Help?

Lumen offers Managed SIEM services to help organizations with their SIEM platform and access a team of security experts with the right skill set to help them deploy, manage, and optimize their SIEM platform according to their business goals and security needs. Working with Lumen could be favorable to organizations to help them benefit from SIEM technologies faster and more effectively while avoiding capital expenses, training costs, and possible disruptions due to security talent turnover.

For more information on Lumen Managed SIEM, view the Data Sheet or visit the product website.

This content is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk. Lumen does not warrant that the information will meet the end user’s requirements or that the implementation or usage of this information will result in the desired outcome of the end user. All third-party company and product or service names referenced in this article are for identification purposes only and do not imply endorsement or affiliation with Lumen. This document represents Lumen products and offerings as of the date of issue.