The operational role of security information and event management systems

Sandeep Bhatt, Pratyusa K. Manadhata, Loai Zomlot

Research output: Contribution to journalArticlepeer-review

145 Scopus citations

Abstract

An integral part of an enterprise computer security incident response team (CSIRT), the security operations center (SOC) is a centralized unit tasked with real-time monitoring and identification of security incidents. Security information and event management (SIEM) systems are an important tool used in SOCs; they collect security events from many diverse sources in enterprise networks, normalize the events to a common format, store the normalized events for forensic analysis, and correlate the events to identify malicious activities in real time. In this article, the authors discuss the critical role SIEM systems play SOCs, highlight the current operational challenges in effectively using SIEM systems, and describe future technical challenges that SIEM systems must overcome to remain relevant.

Original languageEnglish
Article number6924640
Pages (from-to)35-41
Number of pages7
JournalIEEE Security and Privacy
Volume12
Issue number5
DOIs
StatePublished - Sep 2014

Keywords

  • SIEM
  • SOC
  • alerts
  • events
  • security
  • security information and event management
  • security operation center

Fingerprint

Dive into the research topics of 'The operational role of security information and event management systems'. Together they form a unique fingerprint.

Cite this