Security Think Tank: Alerts are great, it’s what you do with them that counts

Security information and event management (SIEM) and security orchestration, automation and response (SOAR) tools often feature in security operations centres (SOCs). SIEM is well established, whereas SOAR is a more recent technology. Understanding what they do and how they fit together is an important part of knowing whether they are right for you.

SIEM tools are one of the cornerstones of an effective SOC monitoring capability. They work by performing real-time analysis of data feeds from applications and infrastructure, correlating that data and alerting analysts when they identify events of interest.

These alerts might point to a breach that is happening, or even better help to predict one, and trigger your response processes.

If you are responsible for security in a medium or large organisation and think you need a SIEM, you probably do – in fact, you probably have one already.

Alongside your SIEM, you probably have a range of additional tools that provide security alerts.

The problem with alerts is that you need to do something with them. You need to validate that they constitute a real incident, for instance by correlating with threat intelligence, and you need to trigger and subsequently manage response processes.

This requires time and effort, sometimes more than is available. For many organisations, the frustration of not having enough security information can quickly be overtaken by the frustration of having too much.

Working with a SIEM can be very demanding, because large numbers of alerts require large numbers of analysts. Worse still, initial alert processing activity can be quite boring, which is why SOC analysts move between employers more often than other cyber security staff.

Managing all this can be a bit of a juggling act, with multiple playbooks, multiple tools and no real integration.

SOAR platforms address many of these challenges and the technology has been developed specifically with the smooth running of a SOC in mind. They can help to manage tools and information sources (including SIEMs), automate analyst processes and co-ordinate response.

They draw together SOC tools and make it easier to work between them. For anyone who has seen a SOC analyst’s desktop, and the number of applications open, the benefits are obvious. By automating some activity, SOAR tools can remove many of the mundane tasks that would otherwise fill an analyst’s day, such as executing attachments in a safe area to check for malware. That can free up time to look at more complex alerts without the worry that something is being missed.

Finally, SOAR tools allow response processes to be formalised, so you can be confident they are being followed. Of course, all of that can be done using other tools, but the benefits of integration are hard to ignore.