{"id":1368,"date":"2018-03-06T13:37:06","date_gmt":"2018-03-06T17:37:06","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=1368"},"modified":"2018-03-06T15:14:40","modified_gmt":"2018-03-06T19:14:40","slug":"key-siem-findings-alienvault-blog-q1-2018","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/","title":{"rendered":"Key SIEM Findings from the AlienVault Blog Q1 2018"},"content":{"rendered":"

\"alienvault<\/p>\n

Here at the Solutions Review Cybersecurity Desk, we like to read through the blogs of the most prominent solutions providers in the field. These vendors are on the frontlines of what may be a burgeoning cyberwar. Therefore they are the most equipped to tell us about the situation on the ground, fighting hackers and nation-states alike.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

This time, we looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault. Here\u2019s the key findings we found:<\/span><\/p>\n

How SIEM Correlation Rules Work by Kim Crawley<\/b><\/a><\/span><\/h3>\n

To get your SIEM solution to work properly, your need to implement SIEM correlation rules. These rules instruct your solution on the particular sequences of events that are indicative of anomalous activity, potential security vulnerabilities, or cyber attacks. When those sequences occur, a security alert is activated and sent to your cybersecurity team.<\/span><\/p>\n

According to AlienVault, SIEM correlation rules can\u2019t stop false positives, it can create a set of warning signs to help limit them and keep your security team aware of potential threats. Improperly set rules, or the default rules straight out of the SIEM box, may make execution time unbearably long, may not encompass all the capabilities your enterprise needs, or may flood your team\u2019s inbox with false positives. SIEM correlation rules need to be designed with care. \u00a0\u00a0<\/span><\/p>\n

By the same token, SIEM event log normalization helps codify the different formats disparate software, hardware, and third-party vendors use to log security events. It compiles all the event information into a consistent, universal style easily read and understood by your cybersecurity team. <\/span><\/p>\n

SIEM Content Engineer – Why Is It a \u201cThing\u201d? By Kate Brew<\/b><\/a><\/span><\/h3>\n

According to AlienVault, legacy SIEM products, often found at large enterprises, are rarely ready for quick deployment out of the box. In most cases, these solutions need a specially assembled team\u2014or at least one truly dedicated person\u2014to set up the custom correlation rules and queries \u00a0\u00a0to make sense of SIEM\u2019s vast compiled logs. <\/span><\/p>\n

Therefore, some enterprises have turned to hiring a SIEM Content Engineer, a somewhat new position responsible for managing SIEM solutions: properly maintaining and deploying it, writing new rules, and ensuring integration, among other duties.<\/span><\/p>\n

AlienVault admits to finding the position a little perplexing just because it is a relatively new title. They do say it is a necessary job, but that security operations centers<\/a> (SOCs)\u2014which can be sole individuals at smaller enterprises\u2014perform much the same responsibilities in addition to other tasks. Furthermore, newer SIEM products may be easier to deploy and may not require the devotion of an SIEM Content Engineer. \u00a0\u00a0\u00a0<\/span><\/p>\n

Crypto-Miners: What Are They and What Steps You Can Take to Protect Yourself by David Bisson<\/b><\/a><\/span><\/h3>\n

Malicious cryptomining software, or cryptojacking, is becoming more popular as cryptocurrencies rise in value and continue to provide anonymity. Cryptomining in itself is fine, as we discussed elsewhere<\/a>. The problem is that malicious actors are hijacking enterprise\u2019s CPU processing power and electrical power by installing secret cryptomining programs on their networks. AlienVault recommends installing browser extensions that target the more popular cryptojacking programs to keep your enterprise safe. \u00a0<\/span><\/p>\n

What We Lack Most in InfoSec: Inherited Credibility by Bob Covello<\/b><\/a><\/span><\/h3>\n

Is what cybersecurity teams, professionals, and leaders need the most not money or resources (although we could certainly use more of both) but respect? Bob Covello of AlienVault argues that because our field lacks inherited credibility\u2014because we are not yet a storied institution in enterprises but still upstarts in many organizations, we aren\u2019t getting the attention or resources we need. This will change, but we need to make a concerted effort to build that credibility over time. \u00a0<\/span><\/p>\n

You can download this guide to SIEM for Beginners<\/a>, this guide to GDPR compliance<\/a>, this guide to building a security operations center<\/a>, and this guide to managed security service providers<\/a>\u00a0all free from AlienVault.<\/p>\n

\u00a0
Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Here at the Solutions Review Cybersecurity Desk, we like to read through the blogs of the most prominent solutions providers in the field. These vendors are on the frontlines of what may be a burgeoning cyberwar. Therefore they are the most equipped to tell us about the situation on the ground, fighting hackers and nation-states […]<\/p>\n","protected":false},"author":41,"featured_media":1237,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[175,86,21,57,22],"acf":[],"yoast_head":"\nKey SIEM Findings from the AlienVault Blog Q1 2018<\/title>\n<meta name=\"description\" content=\"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Key SIEM Findings from the AlienVault Blog Q1 2018\" \/>\n<meta property=\"og:description\" content=\"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2018-03-06T17:37:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-03-06T19:14:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/\",\"name\":\"Key SIEM Findings from the AlienVault Blog Q1 2018\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg\",\"datePublished\":\"2018-03-06T17:37:06+00:00\",\"dateModified\":\"2018-03-06T19:14:40+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg\",\"width\":800,\"height\":400,\"caption\":\"alienvault blog Q1 2018\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Key SIEM Findings from the AlienVault Blog Q1 2018\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Key SIEM Findings from the AlienVault Blog Q1 2018","description":"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/","og_locale":"en_US","og_type":"article","og_title":"Key SIEM Findings from the AlienVault Blog Q1 2018","og_description":"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2018-03-06T17:37:06+00:00","article_modified_time":"2018-03-06T19:14:40+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/","name":"Key SIEM Findings from the AlienVault Blog Q1 2018","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg","datePublished":"2018-03-06T17:37:06+00:00","dateModified":"2018-03-06T19:14:40+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"We looked through the 2018 Q1 blog back-catalog of security information and event management (SIEM) solution provider AlienVault.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/alienvault-mod.jpg","width":800,"height":400,"caption":"alienvault blog Q1 2018"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/key-siem-findings-alienvault-blog-q1-2018\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Key SIEM Findings from the AlienVault Blog Q1 2018"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1368"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=1368"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1368\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/1237"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=1368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=1368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=1368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}