In this lesson,
we're going to discuss the security technology known as a SIEM,
or security information and event management system.
Now, a SIEM is a security solution that provides realtime
or near-realtime analysis of security alerts
that are generated by network hardware and applications.
In our networks, we have a lot of different devices,
including not just our network infrastructure,
but also all our client devices
that we host on the network as well.
To maintain a strong security posture,
it is critical to understand the status
of each of these devices by reviewing their logs,
informational alerts, and events.
But if we had to log into each
of these machines individually to collect
and analyze all that data,
it would take us forever.
Luckily, we have a solution known as SIEM
that helps us overcome this challenge.
as SIEM is able to gather logs and data
from all sorts of different systems
and combine them into a single combined data store.
This allows our cybersecurity analysts,
system administrators, and network administrators
to review the logs and find abnormalities
or things that are not operating within our baselines.
When it comes to reviewing these logs,
it shouldn't be done only after an incident
or after breach has occurred.
Instead, conducting law reviews should be something
that's done regularly and routinely
as part of your network administration
and system management functions.
To effectively conduct a law review and analysis though,
you really do need to utilize a SIEM.
A SIEM is used to help us correlate the events
between different systems across the network,
something that we couldn't do ourselves easily
if we're looking at logs from each individual machine.
Now, by using a SIEM,
we can combine five essential functions
that provides us with a more comprehensive view
of our enterprise network.
This is done by performing log collection, normalization,
correlation, aggregation, and reporting.
Now, first we have log collection.
Log collection of all of our event records
from sources throughout the network is going to happen,
usually using something like Syslog.
This will provide us with important forensic tools
and help us address compliance reporting requirements
as well.
Second, we have normalization.
Normalization is going to map log messages
from different systems into a common data model.
This will enable us to be able
to connect and analyze related events,
even if they're initially logged
in different source formats.
Third, we have correlation.
Correlation is going to link the logs and events
from different systems or applications
into a single data feed,
which speeds up our detection of threats
as well as decreases the time for us
to be able to respond to those threats.
Fourth, we have aggregation.
Aggregation is going to reduce the volume of event data
by consolidating duplicate events
and taking those records and merging them
into a single record.
Fifth, we have reporting.
Reporting is going to be used to present the correlated,
aggregated event data in a realtime monitoring dashboard
if you're an analyst.
And if you're in management,
you're going to get some form of a long-term summary
or report at the end, and that's also part of reporting.
All right, let's consider a simple example.
You're looking through the logs
and you see that somebody has logged in over VPN from Asia.
When you look up the user ID, you see it's John Smith.
All right, that seems normal.
Maybe he's in Asia because he is on a business trip.
Now, while there may be nothing wrong with this,
a few minutes later you're looking at your SIEM
and you see that the access control system says
that John Smith's ID was just used
to log into the server room inside your building.
All right, now we have an issue
because if your server room is sitting in America
and John Smith is supposedly accessing us
from a VPN in Asia,
something is wrong.
Because he can't be both in the server room
and on a business trip in Asia at the same time.
So one of these things has to be wrong.
Now, either of these two events
by themself would be totally fine and not suspicious at all,
but by seeing them correlated together at the same time
or nearly the same time,
this tells us that there's something wrong here
and we need to flag that as suspicious
and investigate it further.
Now as we look into this situation,
we can determine where this person really is.
We can just walk down to the server room
and say, "Is John here?"
And so he says, "No, he is on a business trip in Asia."
Now we need to go check the security footage
and see who is logging in with John's credentials
here in the server room.
A SIEM allows us to do this type of correlation very quickly
and very easily and be able to de-conflict these things.
A security and information event management system,
or SIEM, can be implemented in many different ways.
A SIEM can exist as a piece of software running on a server,
a hardware appliance,
or even as an outsourced managed service.
In order to effectively deploy a SIEM,
you have to consider a lot of different things.
First, you need to be able to log all the relevant events
and filter out anything that's considered
to be irrelevant data.
Second, you need to make sure you establish
and document the scope of the events,
exactly what is it that you're going to log,
what's going to be considered inside or outside of your scope.
Third, you need to develop use cases to define a threat.
This will help you define exactly what you do
and do not consider a threat
and what you may want to take action on or postpone for later.
Fourth, you need to plan incident responses
for given scenarios or events.
If you know that when you see this type of thing occur,
then you need to take those type of actions.
That's what I'm talking about here.
You need to have these pre-planned responses
for any given threat that you might face.
Fifth, we want to establish a ticketing process
so we can track all these different events that we flag.
This way as we go into the SIEM,
we can see something that looks unusual,
like my example of somebody logging in from Asia
and at the local office at the same time,
and then we can flag it
and have it tracked through the process to completion
to make sure nobody forgets about it.
Sixth, we want to make sure we schedule regular threat hunting
by working with our cybersecurity analysts
and using our SIEM.
By doing this,
we want to make sure we're not missing any important events
that may have escaped the automated alerts
that we create inside the system.
By going through and doing threat hunting,
our cybersecurity analysts will be able
to catch bad guys doing bad things
that may have escaped our automated alerts.
And seven, our final consideration
is how we're going to provide auditors
and analysts an evidence trail.
By using a SIEM, we have this great centralized repository
with lots of different data,
and so it becomes a great place for an auditor or analyst
to look through as they're doing their analysis
as part of a compliance-based inspection.
As you can see, there are a lot of great benefits
and considerations that we have when we start using a SIEM.
It's important for us to always properly configure
our network devices to make sure they're feeding their data
into our SIEM within the scope of our events.
Remember, a SIEM is going to take data
using the Syslog protocol.
This means we're going to be using UDP port 514
or TCP port 1468.
As data is being brought into the SIEM,
it's going to be classified based on a log level
from zero to seven.
Zero is our most important or most critical,
and seven is our least important or most informational,
just like we had with our regular devices using Syslog.
For the exam,
it's important to understand the purpose of a SIEM
and that as SIEM relies on the Syslog protocol
to collect the data from all these different network devices
and client devices on our enterprise network,
and then we're going to use that to normalize, correlate,
and aggregate that logging data
into a single repository for further analysis.