- [Instructor] The Security Information and Event Manager
or SIEM
is a specialized device or software
for security event management.
It typically allows for the following functions.
Log Collection
which includes receiving information from devices
with multiple protocols and formats,
storing the logs and providing historical reporting
and log filtering.
Log Normalization
which is a function that extracts relevant attributes
from logs received in different formats
and stores them in a common data model or template.
This allows for faster event classification and operations.
Non-normalized logs are usually kept for archive historical
or forensic purposes.
Log Aggregation
is a function that aggregates information
based on common information and reduces duplicates.
Log Correlation
is probably one of the most important functions of a SIEM.
It refers to the ability of the system
to associate events gathered by various systems
in different formats and at different times,
and creates a single actionable event
for the security analyst to investigate.
Often the quality of a SIEM
is related to the quality of its correlation engine.
Event Visibility is also a key functionality of a SIEM.
Reporting capabilities usually include real time monitoring
and historical based reports.
Most modern SIEMs also integrate
with other information systems
to gather additional contextual information
to feed the correlation engine.
For example, they can integrate
with an Identity Management System
to get contextual information about users
or with NetFlow Collectors
to get additional flow-based information.
Respectively, Cisco ISE and Cisco Stealthwatch
are examples of an Identity Management System
and a Flow Collector
that are able to integrate with most of the SIEM systems.
Several commercial SIEM systems are available.
Cisco partners with several vendors
that offer seamless integration with Cisco products.
The tools in a SOAR are evolving
and so are the methodologies as well.
For example, nowadays we have security analysts
not only responding to basic cyber events
but also performing threat hunting in their organization.
Security Orchestration, Automation and Response or SOAR
is a set of solutions and integrations
designed to allow organizations to collect security threats,
data and alerts from multiple sources.
Security Orchestration, Automation and Response platforms
take the response capabilities of a SIEM to the next level.
SOAR solutions supplement rather than replace the SIEM.
It allows the cyber security team to extend its reach
by automating the routine work of cybersecurity operations.
Unlike traditional SIEM platforms,
a SOAR solution can also be used
for threat and vulnerability management,
security incident response
and security operation automation.
Deploying SOAR and SIEM in solutions together
makes the life of a SOC analyst easier.
SOAR platforms accelerate incident response detection
and eradication times
since it can automatically communicate information
collected by a SIEM with other security tools.
Many traditional SIEM vendors are changing their products
to offer a hybrid SOAR-SIEM functionality.