SIEM is dead? Not so fast: How to use SIEM as an analysis/IR tool

No ratings

Presented at BSidesNola 2017 by

Erika Noerenberg

Recently there has been talk of moving away from traditional SIEM platforms into a security operations and analytics platform architecture (SOAPA). In this new concept, the integration of functionality such as malware sandboxing, threat intelligence, and endpoint monitoring are combined into one platform that also includes a traditional SIEM tool. However, these tools do not have to be mutually exclusive; leveraging a SIEM's log processing and machine learning to aid in incident response can reduce manual analysis time, thereby reducing the mean time to respond (MTTR) for an incident. In this talk, I will demonstrate how common malware and forensic tools such as Volatility or log2timeline can be used as SIEM log sources for aggregation and correlation in an incident response.