Putting it all together – introducing SIEM systems
Hinted at a few times throughout this chapter and referred to several times in previous chapters, a SIEM system is an invaluable tool in any security monitoring effort. It allows us to store a large variety of event logs for all kinds of devices—and device makes, models, and vendors—in a format that allows easy correlation, which in turn allows us to find, alert, and visualize security incidents that span multiple systems or are otherwise hard to discover without the support of a correlation engine. Some examples of SIEM solutions include Splunk (https://www.splunk.com/), AlienVault OSSIM (https://cybersecurity.att.com/products/ossim), LogRhythm (https://logrhythm.com/), Blumira (https://www.blumira.com/), and the Elasticsearch, Logstash, and Kibana (ELK) stack (https://www.elastic.co/what-is/elk-stack).
SIEM will be explained in detail in Chapter 9, Visualizing, Correlating, and Alerting. We will also look...
