My freshly updated “Evaluation Criteria for Security Information and Event Management” (2015 edition) is up on the Gartner site. Admittedly, it is a relatively minor update, but I have expanded sections related to workflow, incident management, threat intelligence, analytics (of course!) and tightened a bunch of various loose ends. As a reminder, the document lists Required, Preferred and Optional requirements for a SIEM tool.
A few fun quotes are below – but really, this document is meant to be used (Excel tool is shipped with it), not perused:
- “Customers must evaluate SIEM on functionality, implementation effort, maintenance effort, ease of operation, scalability up to a desired level, cost and the enterprise maturity of the solution — and must also take into account their monitoring goals and security operations process maturity. ”
- “There is clear segmentation between vendors that commonly appear on enterprise SIEM shortlists (and thus capture the majority of enterprise deployments) and all others (that might also have a few enterprise customers).”
- “SIEM and threat intelligence feeds are a marriage made in heaven. Indeed, all SIEM users should send tactical threat intelligence feeds into their SIEM tools. ”
Other posts announcing research publication:
- My “How to Monitor the Security of Public Cloud Resources” Publishes
- My “Demystifying Security Analytics: Sources, Methods and Use Cases” Paper Publishes
- My “How to Work With an MSSP to Improve Security” Paper Publishes
- Our “Selecting Security Monitoring Approaches by Using the Attack Chain Model” Publishes
- All My Research Published in 2014
- All My Research Published in 2013
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.