Question

What is an example of an In-house SIEM:?

What is an example of an Cloud based SIEM:?

What is an example of an Managed SIEM:?

Answer 1

1.A SIEM (Security Information & Event Management) is a platform for managing security incidents. It allows the collection of system logs and machine data from across your IT environment to help identify unusual or suspicious activity — and then reports an alert in real time if it finds anything suspicious. You can think of a SIEM as a tool that provides a comprehensive view of an organization’s IT security.

In-house SIEM

In this setup, the organization exercises ultimate control on their SIEM solution. They purchase the required hardware and software to implement this solution at their physical facility. As a matter of general practice, SIEM becomes a part of an organization’s Security Operations Center (SOC). An organization can customize this in-house SIEM to meet its security needs and push updates as it wishes.

However, there is no involvement of third-party, and all security-related information remains in-house. The organization becomes solely responsible for integrating an in-house SIEM setup with existing systems, configuring log sources, customizing alerts, and training employees. In-house SIEM setups require a high initial investment and subsequent costs for maintenance, patches, and updates.

Ex: Micro Focus ArcSight ESM.

2.Cloud-based SIEM

This mode has gained significant popularity with the global adoption of cloud computing technology. Cloud-based SIEM solutions are subscription-based, and your responsibilities for maintaining hardware are minimal. Instead of investing a significant amount upfront, organizations have to opt for monthly or annual subscriptions. Customers can decide on the implementation of SIEM for their organization, and there is no reliance on third parties. The trade-off here is the availability of an organization’s security data at locations that are not directly owned or controlled by the organization.

Ex: Sumo Logic

3.Managed SIEM

This model can involve either in-house SIEM or cloud-based SIEM implementation, but with the help of necessary expertise from the service provider. A customer does not need to entirely rely on its internal security team as the vendor would provide support during the implementation. A managed SIEM solution is hosted on the vendor’s server and monitors client network for potential security threats. Primary reasons for choosing managed SIEM solutions are faster deployment, negligible maintenance, flexible pricing options, and availability of SIEM experts on call.

Ex: McAfee Enterprise Security Manager