There’s a legacy connotation connected to SIEM that has led to distributors promoting themselves as some iteration of a next-generation resolution. However is it vital? I’ve been struggling to seek out options that will be labeled as “legacy SIEM”—that’s, SIEM with out some form of automation, response, or anomaly detection capabilities or modules.
It is sensible for SIEM to accommodate all these capabilities. What doesn’t make sense is that this unsynchronized try at differentiating at present’s options from these of 2015.
Let’s have a fast take a look at what SIEM options get referred to as at present:
- Fusion SIEM
- Subsequent-gen SIEM
- Developed SIEM
- Unified protection SIEM
- Cloud-native SaaS SIEM
- “Not a SIEM” SIEM (aka, unified safety operations platform)
So, is that this an issue? Totally different takes on product names is nothing new, however on this case, it creates plenty of confusion out there. First, these names don’t inherently imply something. Positive, some supply indications, like “cloud-native SaaS SIEM platform,” however usually talking, there is no such thing as a goal distinction between a next-gen SIEM and an advanced SIEM.
Second, there are a number of permutations of modules which can be completely different from vendor to vendor. One would possibly supply SIEM + SOAR + UEBA, whereas one other could supply a SIEM + ASM + XDR. Whereas it’s nice to have extra complete safety merchandise, it’s possible you’ll not want or need the extra modules.
“Not a SIEM” SIEM options add one other layer of confusion, as these merchandise do the whole lot a SIEM resolution does, however they received’t present up if you Google “finest SIEM resolution 2024.” One other problem is proving to regulators for compliance functions that though what you employ for SIEM known as a SOC platform, it’s a SIEM resolution.
So sure, I do assume that including adjectives earlier than the phrase “SIEM” is a futile train that creates extra confusion as a substitute of differentiating a product. However there’s extra.
SIEM and Safety Operations
When evaluating options, it’s necessary to resolve whether or not you want a “simply SIEM” or a unified device for automating your safety operations heart. I consider that we should always hold SIEM as a standalone time period that predominantly focuses on doing what it says on the tin—info and occasion administration.
SIEM itself will be a part of a wider safety operations platform alongside applied sciences corresponding to XDR, SOAR, UEBA, and ASM. Nonetheless, for a similar causes offered above, we shouldn’t hold calling these converged options “SIEM.”
Because of this, I’ve adjusted the safety operations stories I’ve been engaged on, specifically the SIEM Radar and autonomous SOC Radar. SIEM focuses on evaluating instruments’ capabilities with respect to info administration. We’re nonetheless together with further features corresponding to automation and evaluation, however they continue to be centered on the primary scope relatively than branching out to full UEBA or SOAR capabilities.
Autonomous SOC, then again, is now a extra standalone method in comparison with its earlier SIEM + SOAR scope. It evaluates the capabilities required by a safety operations heart to handle and automate its every day actions. There’s much less give attention to compliance and extra on response, orchestration, and consumer monitoring.
Subsequent Steps
To study extra, check out GigaOm’s SIEM Key Standards and Radar stories. These stories present a complete overview of the market, define the standards you’ll wish to contemplate in a purchase order determination, and consider how various distributors carry out towards these determination standards.
In the event you’re not but a GigaOm subscriber, you may entry the analysis utilizing a free trial.
The put up Why isn’t “Simply SIEM” Sufficient? appeared first on Gigaom.
