{"id":2547,"date":"2019-04-23T11:56:28","date_gmt":"2019-04-23T15:56:28","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=2547"},"modified":"2019-11-20T15:22:46","modified_gmt":"2019-11-20T19:22:46","slug":"5-factors-in-good-log-management-an-enterprise-guide","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/","title":{"rendered":"5 Factors in Good Log Management: An Enterprise Guide"},"content":{"rendered":"

\"5<\/p>\n

Your business needs good log management to keep up in the cybersecurity battle. Full stop. <\/span><\/p>\n

Why? Simply put, log management serves as one of the most critical cybersecurity capabilities and solutions in the InfoSec arsenal.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

In fact, you could consider Security Information and Event Management\u2014SIEM<\/a>\u2014an evolution of traditional log management solutions; after all, it uses the data logs generated to identify potential security events and create security alerts. We\u2019ve discussed in previous articles the importance of deploying SIEM<\/a> in your cybersecurity platform. Now we face a new set of questions.<\/span><\/p>\n

What makes good log management? What capabilities should your enterprise look for in good log management, both as part of a SIEM<\/a> solution and as its own solution? <\/span><\/p>\n

We break down what good log management truly means below.<\/span>
\n<\/span><\/p>\n

Good Log Management: A Definition<\/b><\/h3>\n

Before we can truly dive into the key factors of good log management, we must first establish a definition for log management. <\/span><\/p>\n

Every component of your IT environment generates data, sometimes in huge volumes. This data contains valuable information such as user activity, data traffic flow records, and autonomous functions. Log management enables your enterprise to collect this information automatically; trying to collect the data manually would result in an overstressed security team and little progress. <\/span><\/p>\n

In a security context, log management helps you identify trends and correlated events contained within the data. With this information, you can determine whether there are potential threats lurking on your network and thus take the proper steps. <\/span><\/p>\n

With that firmly established\u2026<\/span><\/p>\n

5 Factors in Good Log Management<\/b><\/h2>\n

For the sake of readability, we curtailed this list of the key capabilities in good log management. \u00a0Therefore, your business shouldn\u2019t take this as an end-all, be-all guide. Instead, we hope it helps you direct your thinking: whether you select a new solution, upgrade an existing one, or take steps to reconfigure your entire cybersecurity platform.<\/span><\/p>\n

Reach\/Visibility\/Observability<\/b><\/h3>\n

This capability comes with many potential names. However, it works toward a singular goal: turning on the lights so hackers have no dark places to hide. <\/span><\/p>\n

Good log management\u2014 as well as good SIEM and good cybersecurity overall\u2014begins with IT environment visibility. Your enterprise\u2019s network scales at rates you may not fathom until you try to determine its extent. Every new connected device, user, database, third-party, application, or cloud database adds another component to the environment. <\/span><\/p>\n

Additionally, it also creates new attack vectors, targets, and entry points for hackers and insider threats.<\/span><\/p>\n

So many components connecting to your business\u2019 IT environment often results in parts becoming \u201cdark;\u201d in other words, vanishing from oversight and traditional monitoring capabilities. Hackers can and will exploit these dark places to their advantage. As just a few examples, they could use dark areas to penetrate your network undetected, plant a dwelling threat, or move undetected to their real target. <\/span><\/p>\n

Good log management helps uncover the dark parts of your network by collecting relevant data from throughout the entire network. Often, good log management serves as a centralized portal through which you can extend your visibility. It can even find databases your IT security team didn\u2019t know existed (this happens with alarming frequency).<\/span><\/p>\n

Data Normalization<\/b><\/h3>\n

Even after you begin collecting log data from every vulnerable part of the network, you still need to address another challenge; namely, how to understand the intelligence it provides. <\/span><\/p>\n

Every application, database, and device generates data differently. Moreover, each formats their data via different mediums and programs. If they do generate similar logs, the information may still appear as incomprehensible jargon. <\/span><\/p>\n

Neither your team or AI can determine whether a security event occurred if they can\u2019t make sense of the data. How can you solve this problem? \u00a0<\/span><\/p>\n

Good log management automatically normalizes the collected data into a format which allows security event correlation tools to parse it. Ideally, it should also offer the data in a format your IT security team can read and investigate. <\/span><\/p>\n

Machine learning tools can detect potential threats which human intelligence may miss. However, by the same logic, human intelligence can also see what algorithms can\u2019t. Make sure you have a log management solution which can facilitate both.<\/span><\/p>\n

Speaking of which\u2026<\/span><\/p>\n

Search Capabilities<\/b><\/h3>\n

After data normalization, your enterprise may still struggle with finding the relevant data for cybersecurity. For example, say you need the logs from a particular application. In a legacy log solution, you may have to sift through digital piles of documents, folders, and plaintext to even find the application in question. Of course, then you would have to dig through its full data.<\/span><\/p>\n

Good log management should organize the data in an accessible and comprehensible manner. Further, it should allow for easy navigation of the logged data; it should provide your team with the option to input search queries for smooth investigations and vulnerability follow-ups.<\/span><\/p>\n

Secure File and Collection Rules<\/b><\/h3>\n

Every good log management tool helps you collect data. However, you may have good reasons not to collect certain information. <\/span><\/p>\n

Any data traffic generates a certain amount of risk. The same holds true for storing data; if you store it somewhere outside of normal parameters, you invite threat actors to try and steal it. <\/span><\/p>\n

Your enterprise should already have a clear idea of what data you need to protect. Ideally, you shouldn\u2019t begin the cybersecurity conversation without this self-assessment. Once done, you should use a good solution to impose rules on your event data. With rules, you can label the sensitive data the solution should never log management. Additionally, if you must collect the sensitive data in question, you can authorize encryption and set scrubbing time frames.<\/span><\/p>\n

Good log management should never put your enterprise in more risk.<\/span><\/p>\n

Data Storage and Compliance<\/b><\/h3>\n

Technically, our number five entry consists of two capabilities. However, data storage and compliance are so intertwined in their functions they essentially serve as one.<\/span><\/p>\n

Of course, every log management solution generates the same problems for enterprises. What should your enterprise actually do with all the data it collected? Where does it go? How long should it stay in your IT environment before being deleted? <\/span><\/p>\n

A good solution should provide your enterprise with data storage options to suit your particular use-case. These data storage capabilities should allow for preservation, compression, encryption, and archiving to ensure the record\u2019s safety and easy retrieval.<\/span><\/p>\n

Speaking of easy retrieval, good log management should also facilitate governmental or industrial compliance mandates. Many come with out-of-the-box templates for major compliance initiatives; all you need to do is set up the rules for automatic input and you can devote more energy to pressing cybersecurity problems. <\/span><\/p>\n

<\/div><\/p>\n

If you want to learn more about good log management and its connection to SIEM, be sure to check out our Buyer\u2019s Guide<\/a>! We compiled the top vendors in the market, analyze their key capabilities, and provide our Bottom Line for each!<\/span><\/p>\n


Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most critical cybersecurity capabilities and solutions in the InfoSec arsenal. In fact, you could consider Security Information and Event Management\u2014SIEM\u2014an evolution of traditional log management solutions; after all, it uses […]<\/p>\n","protected":false},"author":41,"featured_media":2548,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[353,56,95,145,112,86,212,306,21,57,22],"acf":[],"yoast_head":"\n5 Factors in Good Log Management: An Enterprise Guide<\/title>\n<meta name=\"description\" content=\"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"5 Factors in Good Log Management: An Enterprise Guide\" \/>\n<meta property=\"og:description\" content=\"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-23T15:56:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-11-20T19:22:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/\",\"name\":\"5 Factors in Good Log Management: An Enterprise Guide\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg\",\"datePublished\":\"2019-04-23T15:56:28+00:00\",\"dateModified\":\"2019-11-20T19:22:46+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg\",\"width\":800,\"height\":400,\"caption\":\"5 Factors in Good Log Management: An Enterprise Guide\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"5 Factors in Good Log Management: An Enterprise Guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"5 Factors in Good Log Management: An Enterprise Guide","description":"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/","og_locale":"en_US","og_type":"article","og_title":"5 Factors in Good Log Management: An Enterprise Guide","og_description":"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2019-04-23T15:56:28+00:00","article_modified_time":"2019-11-20T19:22:46+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/","name":"5 Factors in Good Log Management: An Enterprise Guide","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg","datePublished":"2019-04-23T15:56:28+00:00","dateModified":"2019-11-20T19:22:46+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"Your business needs good log management to keep up in the cybersecurity battle. Full stop. Why? Simply put, log management serves as one of the most","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2019\/04\/5-key-factors-in-good-log-management.jpg","width":800,"height":400,"caption":"5 Factors in Good Log Management: An Enterprise Guide"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-factors-in-good-log-management-an-enterprise-guide\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"5 Factors in Good Log Management: An Enterprise Guide"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2547"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=2547"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/2547\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/2548"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=2547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=2547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=2547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}