SIEM Use Case Implementation and Tuning Process

Time to touch the main challenge: SIEM use case implementation / refinement process [also applicable to other monitoring technologies, like UBA / UEBA]. In our seminal paper on the topic, “Security Information and Event Management Architecture and Operational Processes”, (did I mention that it exudes pure awesomeness – from each of its 61 pages!), we have described the process similar to this:

1. Define a particular problem to be solved by a SIEM tool in clear, unambiguous terms.

2. Review the SIEM functionality (rules, algorithms, reports and dashboards) that is needed to solve the problem.

3. Look at the available and potentially available log data that is useful for solving the problem.

4. If a correlation rule is the chosen piece of content to be created, analyze what sequence of logged events needs to be tracked and how these events are represented in a SIEM tool; using normalized events and taxonomy categories is highly recommended because they make the rule easier to modify, maintain and apply to additional log sources.

5. If using a statistical detection method, review its logic to confirm that it will deliver the result needed.

6. Draft correlation rules on paper, and review the logic flow.

7. Implement the correlation rule using the SIEM rule interface; some products allow one to click on events and define a rule straight from the observed sequence of events.

8. If a product has functionality to test the rule or algorithm on historical data, execute this functionality to determine how often this rule would have fired in the past if it had been enabled.

9. Review any alerting process that this rule will trigger, and set up alerts to go to the people who know how to triage them.

10. Enable the rule to run on real-time data flow in the production environment.

11. Review alerts generated by this rule, review the cases where the rule matches partially (if the SIEM product has such functionality) and refine when the rule is needed.

What stages do you think need additional details? Examples? Specific guidance? Any changes?

Select recent blog posts related to SIEM:

• Fun Challenges with SIEM Use Cases
• SIEM Use Case Discovery
• Discovering New Monitoring Use Cases
• SIEM Use Cases – And Other Security Monitoring Use Cases Too!
• Co-Managed SIEM Rising
• Research on Security Monitoring Use Cases Coming Up
• My “Evaluation Criteria for Security Information and Event Management” 2015 Update Publishes
• Do You Want “Security Analytics” Or Do You Just Hate Your SIEM?