Security Information and Event Management + SOC

What is a SIEM?

SIEM or Security Information and Event Management is a technology platform that can detect security events, all while logging information for real-time or historical analysis.

Here’s an example. Someone is copying thousands of files from your server. A SIEM could:

• Identify. The program knows what routine file copying looks like, so this unusual behavior causes alarm. 
• Log. The SIEM keeps track of the problem when it started, and everything it will do next to make the issue stop. 
• Alert. The system sends a notification to appropriate parties that something is happening. 
• Direct. The system could block that individual user from copying files until the investigation is complete. 

Think of a SIEM as a courier vehicle, it drives around your network collecting audit log data from a variety of equipment including, but not limited to, your Firewall, Switches, Wireless Access Points, Servers, Workstations, Antivirus, EDR, etc. It will even collect and monitor all traffic on your network.

What is a SOC?

A SOC, or Security Operations Center, is a team of information security engineers who monitor and analyze system events on an ongoing basis.

If the SIEM is the vehicle, the SOC is the driver. The typical SOC is a centrally managed team of security engineers focused on monitoring specific systems for suspicious activity and often times intervening before attacks become significantly damaging.

A SOC will have engineers from a variety of security-related fields. In addition to security engineers, you might also have leaders who focus on impact, communications, and project/incident management. The SIEM is at the center of the SOC, as the SIEM provides the SOC with the pieces of information they need to take action.

The SOC will follow specific protocols such as monitoring coverage times and standards, steps to be taken in the event of an incident, responses to third parties including potentially law enforcement agencies or attorneys, and others.

ECR is an expert on the various tools Perch offers and leverages that knowledge to support your organization. The toolbox we optimize for your organization includes:

• Security Incident and Event Monitoring (SIEM) – The SIEM captures, parses, and correlates log data from security and networking devices to increase network visibility into anomalies that may be indicators of compromise.
• Behavioral Monitoring – Includes Syslog monitoring, packet capture, service availability, and infrastructure monitoring to detect suspicious behavior that can provide early warning of malicious activity.
• Intrusion Detection – Perch regularly updates Network Intrusion Detection (NIDS) signatures to detect the latest threats that may affect your environment. ECR will implement Host-Based Intrusion Detection (HIDS) agents on your most critical assets.
• Asset Discovery – Uses both active and passive discovery methods. Active discovery loads network configuration to SIEM. Passive discovery watches network traffic and logs data in support of SIEM and Behavioral Monitoring.
• Vulnerability Detection – ECR continuously monitors network traffic comparing it to known vulnerabilities for immediate threat discovery. Active detection scans individual systems and subnets. We will run vulnerability scans on a mutually defined, risk-informed frequency. Based on the quantity of data running through each device; the criticality of the device; the known vulnerabilities associated with the device; and the schedule of automation jobs on, and usage of, each device.