SIEM & Use Case Assessment

SIEM or Security Incident and Event Management systems are intended to provide organisations a ‘one-window’ view of and enhanced visibility into all security-related activity.

The basic building blocks of a healthy and effective SIEM are an effective log management strategy and the underlying cyber capability of an organisation. Put simply, the better and wider the log coverage (monitoring) in an organisation, the better the performance and output of its SIEM and the better the visibility into early malicious activity.

In addition to the above, use cases form an integral part of SIEM systems and organisations rely heavily on use-cases to trigger malicious activity alerts (We call them threat scenarios or cyber-attack scenarios).

In this audit, we assess how your SIEM system is configured, assess the operational aspects of the SOC team and review the related monitoring technology stack. Importantly, we also review a sample of your existing use-cases to highlight any critical gaps in the use-case logic and configurations.

We DO NOT AUDIT the SOC as an operational entity in this assessment.

One of the primary objectives of this exercise is to collate and understand what the expected outcome of the service is. We, therefore, seek to speak to stakeholders including, but not limited to:

• Sponsors of the SIEM project. 
• Service manager/service delivery managers.
• The 'customer' or recipients of the SIEM service.
• Security analysts operating the SIEM.
• Head of Security Operations.
• Information Security representative(s).
• Threat Intelligence Operations. 

During our SIEM assessment, we will:

• Review your existing SIEM configuration.
• Review the use-cases (alerts etc.) that are configured.
• Review the monitoring policy and standards.
• Gain an understanding of your technology landscape ( infrastructure & application). 
• Gain an understanding of the organisation’s critical assets and risk appetite.
• Review incident triage, analysis, and investigations.

• Understand how your approach to log management aligns with NIST's Computer Security Incident Handling Guide: NIST SP 800-61
  Revision 2.
• Determine if your current SIEM implementation, configuration and its coverage are fit-for-purpose.
• Assess a sample of current 'use-cases' and alerts in the SIEM tool and determine if they align with your organisation’s threats, threat actors and risk mitigation strategy.
• Identify improvements in your monitoring and SIEM systems.
• Recommend improvements in your uses and propose new, more relevant use-cases.
• Pinpoint specific technical improvements to boost detection and response capabilities.
• Identify potential cost savings on current and future spends.