Vendor Landscape: Security Information & Event Management

Identify constraints for your SIEM architecture
Consider performance, capacity, and regulatory inputs in your design
process.
• SIEM vendors offer a variety of centralized and distributed
deployment options – sometimes the best design is a mix of both.
• Centralized components typically include log collectors, event
correlation engines, and functions including alerting, reporting, and
incident management tools.
◦ Whether all-in-one or separate but adjacent devices, deploying
these components centrally reduces the management burden for
SIEM.
• Distributed designs may include single-purpose collectors and
combination collector/correlation devices, which can support:
◦ Regulatory requirements (e.g. EU Safe Harbour) that restrict
offshore movement of private/sensitive data.
◦ Performance and scalability needs by aggregating data from log
sources at remote sites and offloading event correlation
processing.
Info-Tech Insight
Cloud-based SIEM solutions (aka
SIEMaaS) are maturing, but have yet to
take over the market. Regulatory
restrictions may limit the applicability of
such services.
In contrast, managed security service
provider (MSSP) solutions, in which a
third party maintains and monitors a
SIEM system housed on customer
premises, offer greater promise today:
• Customer control over sensitive
data.
• Shared access to 24/7 monitoring
at a fraction of the cost.
Info-Tech Research Group
53