The secret to catching intruders with your SIEM is to feed it as much information as possible and we've been doing a better and better job in the infosec world with scaling SIEM technology up and integrating nearly every raw audit log from network devices, operating systems and even applications. But these logs are more raw data than refined information. Don't get me wrong you need all these logs in your SIEM.
But it's time to make sure you are also feeding your SIEM the high value sources of security information from all the other security technologies and products on your network. You want your SIEM to have deep and wide visibility. Visibility at every level of your technology stack and across your entire network.
When you look at the event log spectrum ranging from raw log data to high level/value security information - nothing is higher level, more refined and actionable than security technologies such as your:
- anti-malware
- endpoint security
- network IDS/IPS/forensics
- next generation firewall
- vulnerability scanners
- threat intelligence
- Identity management
- Access control
The list goes on. In this webinar Erick Ingleby, a long time security operations center expert now at LogRhythm, will join me to discuss the opportunity to feed your SIEM extra nutritious event feeds from all the different security technologies on your network. We'll look at real world scenarios and explore how to correlate high level security information like this with the low level stuff coming from more traditional logs.
After this real training for free ™ session, Erick will briefly show you some of the work, the knowledge engineering that the integration teams have been doing at LogRhythm in this area and some specific products they support out of the box.
Your SIEM needs to be as omniscient as possible and the good news is that these high value security feeds are unlikely to make a significant impact to your SIEM compared to the amount of data associated with traditional logs.
Please join me for this important discussion. Register now.