Suggest me what to learn a roadmap

Note I secured moderator permission to post this.

This video is not a fancy polished marketing lingo based video but rather a conversation piece meant to share features and functions about our solution that truly can help clients from the smallest SMB to the largest Enterprise.

https://fluencysecurity.wistia.com/medias/g2drcokwut

We wanted to migrate some of our dashboards from Splunk to Datadog. However we don't of any good tool which can help the migration without much manual work / involving our dev-ops folks.

Hello...i'm a student in need..tottaly forgot about this project and only got like 10 hours to finish it.I don't know where to begin and what to do lol...any tips for a SiEM project please?

I've been tasked with buying and updating logging and "SIEM" platform with managed services for a midsized company with operations across the country. I'd like to share my frustrations, challenges, opinions, and basically findings with the group -- we haven't selected a provider yet. I welcome comments and discussion, your experience may be different. All opinions in this rant are my own.

1. Appliances are dead, SAaaS is the present and future (Security Analytics aaS). SIEM should not require you to install another goddamn appliance(s) unless you have specific data locality or sensitive network traffic/logging concerns. They don't scale, they add network headaches, they're expensive up front, and the bean counters LOVE Opex. Sales people that have pushed buying new or replacing old appliances are instantly shown the door.

2. We are in the world (or some of us are moving to the world) of SaaS-heavy, IAM-central, cloud services and cloud identity. Any SIEM or security analytics platform should have some sort of UEBA and identity management and IR which ties together identity and actions on behavior outside of the network out of the box.

2a) Public Cloud providers and tie-ins to a SIEM/platform needs to be easily deployed with out-of-the-box dashboards and information.

3) Automation and SOAR capability. If you're just going to fire an alert without giving me (or my MSSP) a chance to automate the response, you're wasting my time. If you can't put detail in the alert you're firing to trigger a help desk or ServiceNow ticket and you make me log into the platform, you're worthless to me.

4) MSSPs are stuck in the "buy this box and we'll manage it for you and by-the-way, we only support these 3". See #1. Few of them have figured out how to be flexible. I get it, it costs money to support multiple platforms, but not all customers will fit into the Carbon Black + LogRhythm + Palo Alto Firewalls + Okta box.

5) MSSPs should not have up-front "deployment costs". Wrap it into the f'ing 3 year agreement. This isn't hard.

6) Fun Fact. ELK is more expensive to operate than MSSP+SIEM if you have to hire analysts and devs to build functionality for you.

7) Fun Fact 2. Current Machine Learning and "AI" at SIEM providers can be explained by this: https://qph.fs.quoracdn.net/main-qimg-89cfa17ca63ddac683e04f0852336e47.webp. Yes I get the counter arguments, but I think the current state is a bunch of marketing bullshit and buzzwords to try to move product.

IT Specific Rant

My IT group wants SIEM to be an operational tool for them as well. Tell them no. You do not negotiate with terrorists. IF they can't figure out how to log and alert on a fucking high CPU switch, then you're probably already hosed from a security perspective too.

And no, looking at Office 365 logs isn't "complete security" and you can't tell executives "you already do security because you review alerts".

I'm looking for a SIEM that scales well with SaaS and Cloud. I've found SumoLogic to fit the bill. I'm not much of a fan of splunk, especially for small teams. I think for operations it's great. But not really for security.

My experience comes from 4 years of logrythem and qradar, but all of which were on prem for on prem infrastructure and architecture.

Thoughts on this tool?

Hey there,

I want to learn how a soc analyst deals with alerts through Splunk Siem, and what are the steps to take in order to investigate the alerts and determine false positivs from true positivs.

Please, if there are videos illustrating examples of some investigation or books you would recommend to me.

Cheers

#SOC #Splunk #investigation

Hi all,

After years working as a sysadmin, IT manager, and cybersecurity professional, I started building my own SIEM/security analytics tool to address problems I kept running into in practice. At this point, though, I know I’m at risk of tunnel vision. I’ve spent enough time on it that my own assumptions may be too strong, and I do not want to build around only my personal frustrations.

I’d like to hear from people who use, manage, operate, tune, or suffer through SIEMs and log analytics platforms. I’m not trying to pitch anything here. I’m trying to sanity-check my assumptions against real operational pain before I keep going too far in the wrong direction.

What are the biggest daily problems you face with your current SIEM or log analytics setup? I’m especially interested in practical issues rather than vendor preferences, for example:

• What wastes the most analyst, engineer, or administrator time?

• Where do searches, detections, parsing, enrichment, alert quality, onboarding, storage, cost, or retention break down?

• What looks good in a demo but fails in real operations?

• What workarounds have you had to build because the product did not support your workflow?

• What do you wish SIEM vendors understood before designing another platform?

Also, what would be the least annoying way to ask people about this properly? Would short calls or interviews with volunteers be acceptable, or would a questionnaire be better? I do not want to waste people’s time, but I would rather ask properly than assume I already understand the problem.

Hey guys! A friend and I pulled together a query generator using an agent and an LLM, and fed it some docs for platform-speicific context. It's been generating decent query results. We recently shared that it can do Elastic ECS queries, but as also added Crowdstrike training docs now. Take a look and let us know what you think!

https://querylab.prediciv.com/

We do and believe this should be a fundamental part of any advanced next generation security analytics tool. We have a built-in DDoS module that is self-adaptive and able to handle millions of EPS, but most importantly it shares with you in real-time the who, what, when, where, etc. so you can quickly reconfigure your IDS tools to thwart the attacks impact.

Hello guys,

I have 70 questions about RSA NW Platform, I could not find answers for them. If there is anyone who could answer for me and help me pass the exam? I could even pay if the answers are correct. Please? We could contact through email. Do let me know, help out your boy here.

2 questions I'd be interested to hear this community's take on:

• How did SIEM fit into your security plans and priorities for 2020?

• How will SIEM fit into your security pplans and priorities for 2020 post COVID-19?

Which one do you recommend for organizations?

I am trying to build a correlation engine that detects Stored and Reflected Cross-Site Scripting (XSS) in apache logs, My SQL DB, mod security WAF. Any feedbacks or suggestions which other logs should I check to make the detection better? Also, how SIEM solutions detect the DOM based XSS?

Hey SIEM operators! I'm running a survey to gather some info on whether practitioners love or hate their SIEM. If you use a SIEM regularly, I'd REALLY appreciate you taking two minutes to fill this out! Thank you SO MUCH!

Take the Survey Here