Overview
In this paper, you are required to research the advantages that a Security Information and Event Management (SIEM) system offers to a defensive security team. Your research should draw from various sources, including videos, reading materials, and internet research, to explore how a SIEM system is pivotal in meeting the needs of a Security Operations Center (SOC) analyst. The paper should detail the various essential functions and capabilities that a SIEM system provides in the context of cybersecurity operations. Please review the scenario listed below and answer the prompts.
Task
Scenario: Your SOC manager has requested you research a logging solution that will enable your team to collect log data, network telemetry, and system information to help correlate events by ingesting this data into a centralized repository (SIEM). This manager has asked that you research and provide recommendations on two SIEM solutions. However, certain requirements will need to be answered before they can request funding to pay for this project. Listed below are the requirements for this project. You may use this module’s reading and videos as well as external research from the internet to provide you with the information you need. Once you have completed your research, please write a recommendation based on the prompts list below.
Address the following prompts by comparing the two competing products:
What is the name of the product?
What types of log data can be ingested and “normalized” into a human-readable format?
What types of devices could have their information logged?
Are there any defensive security components that a SOC team can use to their advantage?
Is there a way to incorporate threat intelligence feeds to monitor for potential “Indicators of Compromise”?
Is there any reporting functionality that could inform management of any potential cybersecurity events?
This research paper should be 1000 – 1500 words in length
