Cloud Security Podcast by Google

EP184 One Week SIEM Migration: Fact or Fiction?

Aug 5, 2024

Manan Doshi, a Senior Security Engineer at Etsy, shares insights on the challenges of migrating to a new SIEM platform. He discusses key hurdles organizations face and debunks myths surrounding flawed tools, emphasizing the importance of processes. Manan reveals the exciting prospect of completing a SIEM migration in just one week and explores the role of AI and 'Detection as Code' in enhancing detection logic. His focus on community insights and strategic planning highlights how a strong engineering culture can transform security operations.

24:45

Creator website

Episode guests

Manan Doshi

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Organizations should prioritize simplicity over extensive feature sets during SIEM migrations to improve efficiency and reduce complications.

Implementing 'Detection as Code' enhances collaboration and control over security detection processes, leading to more effective migration outcomes.

Deep dives

Lessons from SIM Migration Challenges

Organizations often face significant challenges when undergoing SIM migrations, a common experience highlighted by a senior security engineer. After completing three migrations, the engineer found that an overwhelming focus on numerous evaluation criteria could lead to complications and inefficient choices. Instead, a shift towards simplicity was recommended, focusing primarily on essential functionalities like searching and detection writing, rather than an exhaustive list of features. This realization emphasizes that older, feature-rich tools may not provide the necessary value, suggesting that keeping the approach simple can streamline the transition process.

Intro

4min

Navigating SIEM Migrations

10min

Enhancing Detection Logic Through Code Management

2min

Navigating Test Modes and Sample Data in Security Tools

2min

Rapid SIEM Migration Success

7min

Guest:

Manan Doshi, Senior Security Engineer @ Etsy

Questions:

In your experience, what are the biggest challenges organizations face when migrating to a new SIEM platform? How did you solve them?
Many SIEM projects have problems, but a decent chunk of these problems are not about the tool being broken. How did you decide to migrate? When is it time to go?
Specifically, how to avoid constant change from product to product, each time blaming the tool for what are essentially process failures?
How did you handle detection content during migration? Was AI involved?
How did you test for this: “Which platform will best enable our engineering team to build what we need?”
Tell us more about the Detection as Code pipeline you use?
“Completed SIEM migration in a single week!” Is this for real?

Resources: