SIEM has been a crucial component of security systems for nearly two decades. While there’s ample information on operating SIEM solutions out there, guidance on evaluating and managing them effectively is lacking.
We’ve noticed many SIEM vendors are taking advantage of this dearth of knowledge and not providing customers with needed value for what they’re buying.
With that in mind—and drawing from our experience as both buyers and sellers of SIEM software—we’re offering advice to help you save costs, streamline your security operations, and establish a successful partnership with your SIEM vendor.
Here are three key points to consider when engaging with a SIEM vendor so you can maximize your value, which are all included in our How to Maximize Your SIEM Value guide that you can download now.
1: Tailor the SIEM to Meet Your Needs
When evaluating a SIEM, you’ll need to recognize that a one-size-fits-all approach rarely works. No matter what a vendor may tell you, your needs around SIEM are not going to be the same as an organization twice your size, or half your size for that matter.
Assess the volume of logs you will send to the SIEM, and determine the pricing model that suits your organization. Calculate the log volume from different sources and beware of vendors who charge based on the number of employees.
Additionally, it’s important to invest the appropriate time and resources into your SIEM project. Determine the level of involvement your vendor will have during the evaluation and implementation phases, and ensure the vendor commits skilled technical staff to execute the evaluation and later implement the SIEM.
You can’t discount how your system may evolve, either. Consider your future SOC tooling roadmap and verify if the SIEM can integrate with other technologies you might adopt in the future.
2: Understand the Technical Details
It’s your job in evaluating and maximizing value from these systems to get down into the technical details. You’ll need to fully grasp the vendor’s front- and backend software architecture, even for those claiming to be “true SaaS” or “cloud-native.” Be cautious of legacy vendors repackaging their on-premises software as cloud-native solutions. Be sure to request details of the backend architecture to ensure transparency.
Then you must make decisions during implementation that will have a positive long-term impact on user experience and SIEM utility. Prioritize data sources based on their return on investment and start with easy-to-parse, low-volume logs. Save more complex data sources for later stages. Continuously optimize data sources to reduce costs and improve investigation efficiency.
3: Keep Budget in Mind
Got a budget and a timeline for your project? Vendors will be thrilled to hear that. That’s when they’ll be aggressive in their attempts to win your business. You can use this to your advantage depending on your vendor’s culture. Some deal fairly, some don’t.
Establish a clear budget and timeline for your SIEM project. Share this information with the vendor, provided they have a reputation for fair dealing. If dealing with a less reputable vendor, keep your budget confidential to avoid being taken advantage of.
Be aware of additional costs, such as professional services for implementation and potential costs for switching vendors.
As a recap: to maximize the value of your SIEM investment, it is essential to carefully evaluate, implement, and maintain the solution. Consider factors such as log volume, team resources, technical architecture, budget, and long-term sustainability.
If you’d like to learn more about how to get the most out of your SIEM investment, download the How to Maximize Your SIEM Value guide now.
Leave a Reply