Vendor Landscape: Security Information & Event Management

Determine how and where SIEM will help you manage risk
Adopting the right SIEM tool depends on what risk-related focus is most
important to your organization.
All SIEM tools provide log management functionality – collecting, aggregating, and
normalizing log data from diverse sources. Whether the enterprise chooses to move further
or not, every organization can benefit from Log Management.
Many organizations look to SIEM
primarily as a way to reduce the cost
of meeting internal and
external/regulatory compliance
requirements:
Consolidated logs feed out-of-the-box and
custom compliance reports. In some cases,
SIEM workflow capabilities add value by
tracking mandatory log review processes.
Typically, organizations
see both compliance
and event
management-related
benefits as SIEM is
integrated into the risk
management toolbox.
Other organizations look to SIEM
primarily as a means to reduce the
effort expended when responding to
individual security events and
incidents:
Correlated events provide earlier visibility
into active threats. Consolidated logs allow
more rapid and thorough investigation of
events either in progress, or after the fact.
Many organizations take a final step, leveraging the information provided by the SIEM tool
to target specific changes to (or investments in) system security and operational controls
as a key component of a continuous risk management program.
Info-Tech Research Group
9