TL;DR
Security Information and Event Management (SIEM) software unifies threat detection, event logging, and real-time alerting into a single platform. By integrating with firewalls, antivirus tools, databases, and user terminals, SIEM helps organizations identify brute-force attacks, stolen credentials, and malware before damage spreads. While powerful, SIEM solutions carry significant costs and require ongoing human oversight — making them best suited for large organizations or those with strict compliance requirements. When evaluating vendors, prioritize machine learning capabilities, integration depth, and compliance reporting features.
SIEM tools were originally developed to assess your current security system and spot threats. If they find an issue, this same system can stop the problem before it worsens.
Understanding SIEM tools and their benefits
SIEM tools are powerful, and in some industries, they're mandatory. It's almost impossible to look over every corner of a large system without a SIEM. And if a problem occurs, the event reporting you'll get from your SIEM can make your life easier.
But if you run a small company with a tiny staff, the time and effort you expend in finding the right SIEM and installing it could be better spent elsewhere.
Where do you fall on this spectrum? And what should you look for in a software partner? Let's dig a little deeper.
What is SIEM?
Gartner defines SIEM as a technology that can both detect and block security events, all while logging information for real-time or historical analysis.
Here's an example. Someone is copying thousands of files from your server. A SIEM could:
- Identify. The program knows what routine file copying looks like, so this unusual behavior causes alarm.
- Log. The SIEM keeps track of the problem, when it started, and everything it will do next to make the issue stop.
- Alert. The system sends a notification to appropriate parties that something is happening.
- Direct. The system could block that individual user from copying files until the investigation is complete.
How did SIEM evolve from SEM and SIM?
SIEM tools were born from a combination of security event management (SEM) tools and security information management (SIM) solutions. Rather than buying two pieces of software to spot threats and address them, companies pushed for one program that could tackle both tasks. Reporting capabilities grew from legislation (such as the Payment Card Industry Data Security Standard (PCI DSS)), which required accurate logs.
Modern SIEM tools lean on the power of machine learning. If the system can't understand what normal behavior looks like, programmers must supply the data, and that's time-consuming. Adding in machine learning allows the program to learn on the fly, and with each passing day, it grows more powerful and helpful.
With this power comes a hefty price tag. A SIEM can be expensive to purchase, program, and maintain. For that reason, large organizations and public companies tend to be the largest consumers of SIEM solutions.
How does SIEM work?
How can SIEM be a detective and an enforcer at the same time? Integration is critical.
Your SIEM connects to all sorts of devices within your network, including:
- Antivirus software
- Applications
- Databases
- Firewalls
- User terminals
Each one of these points sends data into the SIEM. All of those bytes slide into a management console. Sometimes, the programs rely on humans to sift through all of the information and make sense of it.
How does a SIEM manage and prioritize data?
Close to 80 percent of IT professionals already consider their work stressful. Giving them yet another dashboard filled with hundreds of data points may not make them feel at ease. But a SIEM is a little different than a traditional security tool.
SIEMs can also rate the danger of a specific trigger or alert. You could choose to watch only the issues the program thinks is critical, and you could analyze the other logs later.
A full-service SIEM solution can handle these specific tasks:
- Alert. A SIEM tells security professionals the exact moment it detects an issue.
- Collect. The program pulls information from multiple sources and places each data point in one place.
- Compare. A SIEM can look at what's happening now and compare it to programming, prior problems, or normal activity.
- Present. It presents data points in a consumable dashboard.
- Record. SIEMs collect data for compliance purposes. And they save the data in case a team needs to look back at the record later.
Every tool is different, and some offer functionality we didn't mention here. But this short list gives you an idea of what a SIEM is and what it can do.
What are the benefits and limitations of SIEM?
Investing in a new security solution takes time. In most companies, several people are involved in every purchase decision. And if you're looking at a SIEM, you'll have dozens of vendors to choose from. Is it worth the effort?
| Benefits | Drawbacks |
|---|---|
| Compliance reporting. About five years ago, many tech professionals started worrying about the number of standards and regulations they had to follow regarding security. Rules have exploded since then. A SIEM could make meeting all of those standards and documenting compliance easy. | Cost. Powerful software comes with a big price tag. For some companies, this solution is simply too expensive to implement. |
| Pattern formation. It's hard to spot a hacker's scout. SIEM reporting and dashboards could help you visualize minor problems, when they're easier to solve. | Time. Humans must supervise SIEM solutions, and since they work around the clock, staff must be available too. |
| Increased security. All of the data a SIEM can give you can help you stop attackers in their tracks and protect your company's critical resources. | Panic. SIEM solutions can flag up false-positive problems. |
| Reputation management. If something goes wrong, you'll have dashboards and data to analyze. When you're called into a meeting to explain what happened, you'll have the answer. | Short shelf life. A traditional SIEM program has a shelf life of just 18 to 24 months. If you do want to invest in SIEM, you should keep an eye out for modern programs that can work for your organization for the long haul. |
| Crisis concerns. A SIEM can, in some cases, stop an attack even before you know something went wrong. | N/A |
Ensure that your purchase team understands these pros and cons before you start the shopping process. You may decide that SIEM just isn't right for you, or you may be even more eager to get started.
What common attacks can a SIEM detect?
We've mentioned that SIEM can look over data and spot unusual or troublesome behavior. What exactly could a tool like this find?
SIEM solutions have been useful in spotting:
- Brute force attacks. A hacker guessing a password thousands of times in minutes hasn't just forgotten a password. That person is attempting to force entry. A SIEM could identify those thousand attempts as erroneous.
- Stolen identity. A user logging in from an unusual country or strange time zone could be a hacker. A SIEM could spot that issue as cause for concern.
- Malware. When tied to your antivirus software, a SIEM could spot the moment a hacker deploys a malicious program. If the software doesn't remove it immediately, the SIEM could step in.
In essence, programs like this understand what normal looks like. Then, they alert you whenever something unusual happens. The results can be amazing.
Is SIEM for you?
If you are shopping for SIEM, you have plenty of vendors to choose from. IBM, Intel, Trustwave, and others all sell products in this market. How can you make the right choice?
Ask each vendor about:
- Integration. Will the software work with all of the programs, servers, and systems you have in place right now?
- Programming. Does the tool use machine learning? Or must you help it understand what threats look like?
- Reporting and logs. What do typical dashboards and reports look like? Can the system spit out reports per your specific compliance landscape?
Should you wait for next-generation SIEM?
If you're not ready to shop just yet, it might be wise to wait for the next iteration of SIEM. Experts think newer programs will come with more automation, better machine learning capabilities, deeper collaboration, more integration, and better cloud functionality. If any of these attributes are critical for your business, waiting can be wise.
Get Critical Help With Okta
Get insights into the threats you face and the solutions you need. Okta's solutions are intuitive and powerful, and they're remarkably easy to deploy too. Learn how we can help you detect threats. Contact us to find out more about how to get started.
Frequently asked questions
What is the difference between SIEM, SEM, and SIM?
Security Event Management (SEM) and Security Information Management (SIM) were originally separate tools — SEM focused on threat detection and response, while SIM handled information management. SIEM combines both functions into a single platform, allowing organizations to detect, log, alert on, and respond to security incidents without needing two separate solutions.
Is SIEM worth the investment for small businesses?
For small companies with limited staff, the time and cost required to select, implement, and maintain a SIEM solution may outweigh the benefits. SIEM tools are most valuable for large organizations and public companies that face complex compliance requirements and manage extensive networks. Smaller businesses should carefully weigh the cost and staffing demands before committing.
How does a SIEM detect threats like brute force attacks or stolen credentials?
A SIEM establishes a baseline of normal behavior across your network. When activity deviates from that baseline — such as thousands of failed login attempts in minutes (brute force) or a user logging in from an unusual country or time zone (possible stolen identity) — the SIEM flags it as suspicious, alerts security staff, and can take automated action such as blocking the user.
What are the biggest drawbacks of traditional SIEM solutions?
Traditional SIEM programs can be expensive to purchase and maintain, require around-the-clock human supervision, and are prone to generating false-positive alerts that can cause unnecessary alarm. Additionally, a conventional SIEM has a shelf life of only 18 to 24 months, meaning organizations may need to reinvest in newer solutions relatively quickly.
What should I ask a SIEM vendor before purchasing?
When evaluating SIEM vendors, ask about integration compatibility with your existing programs, servers, and systems; whether the tool uses machine learning or requires manual threat programming; and what compliance reporting capabilities are available. Understanding these factors will help ensure the solution fits your organization's specific security and regulatory landscape.
What improvements are expected in next-generation SIEM tools?
Experts anticipate that newer SIEM platforms will offer greater automation, more advanced machine learning, deeper integration with cloud environments, and improved collaboration features. If these capabilities are critical for your organization, it may be worth waiting for the next generation of SIEM solutions rather than investing in a legacy platform now.
References
Security Information and Event Management (SIEM). Gartner.
Machine Learning Log Analysis Platforms—The New Wing Man to SIEM? (February 2020). SC Media.
Is IT Work Getting More Stressful, or Is It the Millennials? (May 2015). Computerworld.
Awash in Regulations, Companies Struggle With Compliance. (August 2019). Forbes.
An Evaluator's Guide to NextGen SIEM. (2019). SANS Institute.
