Introduction
Security Information Management (SIM)
Specialized security software which helps collect monitor and analyse security events
Collect data from legs and translates it into a easily usable format
Monitor events in real time
Send and generate alerts and reports
Automate incident response
Correlation of data from multiple sources
Translation of event logs
Easy to deploy
Store and analyze large volumes of data
Fast and efficient analysis
Correlate logs and events to provide the most accurate overview of the system
Allows for easy threat management
Can be expensive
Not certain they can properly adapt to working environment
Not all providers provide full technical support
Security Event management (SEM)
Specialized in identification collection monitoring evaluation notifications and correlation in real time of events and alerts
Used to identify suspicious behaviour
Real time monitoring
Obtain security events in devices and applications within the system.
Correlation of events provide clear picture of the system
Analyze logs
Real time incident response
Centralization of information
Reduction of false positives
Improvement in response time
Hard to deploy
High cost can prevent failures
Security information and event management
Aggregates and analyzes information
Combination of SIM and SEM
Configure devices to send logs to SIEM
Advanced threat detection
Forensic and incident response
Compliance reporting and auditing
SIEM Platforms
Graylog open source and enterprise versions
ARCSight
QRADAR
Logrhythm
Splunk
Last updated