My “Evaluation Criteria for Security Information and Event Management” 2015 Update Publishes

My freshly updated “Evaluation Criteria for Security Information and Event Management” (2015 edition) is up on the Gartner site. Admittedly, it is a relatively minor update, but I have expanded sections related to workflow, incident management, threat intelligence, analytics (of course!) and tightened a bunch of various loose ends. As a reminder, the document lists Required, Preferred and Optional requirements for a SIEM tool.

A few fun quotes are below – but really, this document is meant to be used (Excel tool is shipped with it), not perused:

• “Customers must evaluate SIEM on functionality, implementation effort, maintenance effort, ease of operation, scalability up to a desired level, cost and the enterprise maturity of the solution — and must also take into account their monitoring goals and security operations process maturity. ”
• “There is clear segmentation between vendors that commonly appear on enterprise SIEM shortlists (and thus capture the majority of enterprise deployments) and all others (that might also have a few enterprise customers).”
• “SIEM and threat intelligence feeds are a marriage made in heaven. Indeed, all SIEM users should send tactical threat intelligence feeds into their SIEM tools. ”

Enjoy!

Other posts announcing research publication:

• My “How to Monitor the Security of Public Cloud Resources” Publishes
• My “Demystifying Security Analytics: Sources, Methods and Use Cases” Paper Publishes
• My “How to Work With an MSSP to Improve Security” Paper Publishes
• Our “Selecting Security Monitoring Approaches by Using the Attack Chain Model” Publishes
• All My Research Published in 2014
• All My Research Published in 2013