Zero Trust Security

Chapter 9 Security Information and Event Management

During your morning meeting with the security analysts, a concerning pattern emerges. The team is spending hours each day manually checking multiple security systems, making it nearly impossible to correlate events or identify sophisticated attacks that span multiple systems. This fragmented approach not only reduces team efficiency, but also increases the risk of missing critical security incidents. It’s clear that centralising security monitoring has become a business imperative.

With the current setup, we have two places that are currently monitoring for security-related events. That being network monitoring using Suricata, and the endpoint protection with Velociraptor. With our small setup of just two monitoring tools, it is not too painful to check each monitoring system for potential incidents. That a completely different story for large organisations, it is not unrealistic to have between 15 and 20 security tools, and monitoring all of them for alerts can be difficult and time-consuming.

That is what Security Information and Event Management (SIEM) is supposed to help with by centralising all the alerts. This is done by collecting all the events from the different security tools into a single place. Enable analysts to manage and analyse these logs in a centralised location. Another benefit of SIEM is that it makes it possible to correlate security alerts from different tools, allowing for new detection possibilities. ...