Enterprise Security Weekly (Audio) SIEM: Shakeup in Event Management - What's Happening in the SIEM market today? - Jason Shockey, Seth Goldhammer - ESW #377
18 snips
Sep 27, 2024 Seth Goldhammer, VP at Greylog, sheds light on the SIEM market's transformation and the challenges it faces. Jason Shockey, founder of MyCyberPath.com, shares his passion for guiding cybersecurity career navigation. They discuss the evolving SIEM landscape, the critical role of situational awareness, and the impact of AI and machine learning. Shockey also emphasizes the importance of lifelong learning and personal attributes in cybersecurity careers. Anecdotes and insights make for a rich conversation on both current trends and future possibilities.
AI Snips
Chapters
Transcript
Episode notes
Core Functions of SIEM Today
- A SIEM should focus on data collection, processing, normalization, storage, and analytics to prioritize security events.
- The fundamental promise of SIEM remains to align human resources on what requires investigation.
Early SIEM Tech Struggles
- In 2004-2005, an exhaustive SIEM deployment caused overloaded storage and sluggish queries lasting up to eight hours.
- This historical challenge highlights how far SIEM technology has evolved in managing large log volumes.
Contextualizing and Prioritizing Events
- Effective SIEM contextualization involves understanding who, what event occurred, and the risk posed by the system's role.
- Multiple suspicious activities targeting the same entity signal a more credible threat worthy of attention.