Without deep analysis, SIEM is useless

[[email protected]]

Modern DLP systems accumulate a huge array of various data and become excellent data providers for SIEM (Security information and event management). SIEM technology provides real-time analysis of security events emanating from network devices and applications.

Most systems use an agent solution, in which special software not only collects transmitted data, but is also able to monitor the technical condition of the equipment, the software used and the hardware configuration, the actions of the user or services in the system, and much more.

Our experience also confirms the close connection between modern DLP and SIEM. Over time, DLP from SearchInform began to “grow” with new modules and be supplied with additional functionality. As a result, the life and tasks of our clients led us to create our own SIEM. This happened naturally, so there are no problems with the integration of our DLP and SIEM.


via GIPHY

I would like to point out that one system does not replace the other, they solve different problems. A simple example: an employee entered an incorrect password several times. SIEM will not only detect these actions, but also compare factors - how many times was the password entered incorrectly? Over what period of time?

The system will detect a threat to information security - uae whatsapp number list someone is trying to guess the password to the "account" - and will notify about it in a timely manner. DLP, in turn, will allow you to detail the data and find out the details of the incident. Such a symbiosis of SIEM and DLP significantly increases the level of information protection of the organization and simplifies the work of the security service.

Currently, DLP developers are actively integrating their solutions with popular SIEM systems. The process is just gaining momentum and it is too early to talk about specific results. For vendors, integrating their data into SIEM is not a quick process, because it is not enough to give data to a third-party system, it is necessary to understand what specific tasks such a scheme can solve, how exactly such an alliance will help.