Security Information and Event Management (SIEM) in the cybersecurity domain started out as a compliance tool but has now evolved into an advanced threat detection platform for organisations. During the development journey of SIEM tools, there was a brief period when it was considered that SIEM is ‘dead’ but it was not because of the absence of the need for it but because SIEM's fundamental capabilities needed an upgrade.

Everyone at Devo is proud of the way our cloud-native logging and security analytics platform empowers security and operations teams to maximize the value of all their data. We have recently received kudos from industry analysts and awards from several industry organizations.

Modern day Security Information and Event Management (SIEM) tooling enterprise security technology combine systems together for a comprehensive view of IT security. This can be tricky, so we’ve put together a simple SIEM tutorial to help you understand what a great SIEM provider will do for you. A SIEM’s responsibility is to collect, store, analyze, investigate and report on log and other data for incident response, forensics and regulatory compliance purposes.

SIEM (Security Information and Event Management) systems have a reputation for being expensive. And that’s generally correct – they can cost hundreds of thousands per year or have huge upfront costs. But why is that? There are several main reasons: All of this is changing. According to Gartner, SIEMs are going to the mid-market and these things don’t hold true there.

Halloween is tomorrow, and do you know what that means? For starters, it means you can dance under the rare blue moon. A full moon visible for all time zones on Earth hasn’t happened since 1944, and won’t happen again until 2039. It also means you can don a costume and be anything you like. Kind of like a fraudster, that assumes a new persona every time there is a payment fraud attack.

While all cybersecurity professionals agree that log management is integral for robust proactive and reactive security, managing the enormous amount of data logs can be a challenge. While you might be tempted to collect all logs generated from your systems, software, network devices, and users, this “fear of missing out” on an important notification ultimately leads to so much noise that your security analysts and threat hunters cannot find the most important information.

The number of cyberattacks has increased five-fold after COVID-19, as the pandemic brought new opportunities to cybercriminals. At this rate, cybersecurity threats are estimated to cost the world US $6 trillion a year by 2021. Since remote working became “the new normal”, it also became a growing gateway to new forms of data theft and as a result, companies face significantly increased risk of cyber-attacks and data breaches.

Alert fatigue is a well-known phenomenon with security products – the security team gets a lot of alerts (from the SIEM, for example), it tries to triage and act upon all of them, but at some point, they are so many and so few of them are actual threats, that the security team just ignores them. And that leads to both overworked security teams and an increased risk for missing an actual threat. Why is that happening? It’s hard to tweak a system right, no matter how flexible it is.

SIEM stands for Security information and event management. This technology has existed since the late 1990s. Traditional SIEM has been joined by a broad use log management technology that focuses on collecting various types of logs and events for different purposes, such as: SIEM vendors usually provide different combinations of functionalities to offer the benefits listed above.