Looking for SIEM use cases and triggers

Hi everyone,

I am looking for SIEM use cases and triggers.

On this thread https://www.peerspot.com/questions/what-are-the-top-use-cases-to-implement-after-deploying-a-siem, @David Swift said he has written SANS papers. I have looked for them (in white papers and gold papers) and cannot find them. Would anybody be able to help please? I found two papers on the wikipedia page, maybe there is more?

Other helpful resources would be good too, if any. Do you know other papers/documents listing SIEM use cases and triggers please?

Thank you for your help.

Kind Regards,

Bertrand

Works

Buyer's Guide

Security Information and Event Management (SIEM)

May 2026

Get the category report

Helped 900,051 peers since 2012

5 Answers

Last answered Mar 29, 2022

David Swift

Works

Real User

Mar 23, 2022

You may also want to consider the MITRE ATT&CK framework.

https://attack.mitre.org/

Search for a product comparison in Security Information and Event Management (SIEM)

David Swift

Works

Real User

Mar 23, 2022

Best Practice Papers

Additional detail is available in several public papers vetted by SANS that have become industry best practices.

 A Process for Continuous Security Improvement Using Log Analysis

https://www.sans.org/white-pap...

#33824

 Successful SIEM and Log Management Strategies for Audit and Compliance

https://www.sans.org/white-pap...

#33528

 A Compliance Primer for IT Professionals

https://www.sans.org/white-pap...

#33538

 A Practical Application for SIM/SEM/SIEM Automating Threat Identification

https://www.sans.org/white-pap...

#1781

Bertrand

Works

User

Mar 25, 2022

@David Swift thank you

siemusecases

Works at a consultancy with 51-200 employees

User

Mar 29, 2022

https://www.siemusecases.com is the probably the best starting point.

Bertrand

Works

User

Mar 25, 2022

David has answered my question. Thank you!

Evgeny Belenky

Director of Community at PeerSpot (formerly IT Central Station)

Real User

Mar 23, 2022

Hi @David Swift and @Chiheb Chebbi, possibly you can help @Bertrand in answering their question.

Thanks!

Buyer's Guide

Security Information and Event Management (SIEM)

May 2026

Download Free Report

Find out what your peers are saying about Splunk, IBM, Wazuh and others in Security Information and Event Management (SIEM). Updated: May 2026.

DOWNLOAD NOW

900,051 professionals have used our research since 2012.

Security Information and Event Management (SIEM)

SIEM integrates real-time monitoring with advanced analysis of security events. It consolidates functions to provide comprehensive threat detection and response, enhancing organizational security measures.SIEM solutions offer extensive threat intelligence, enabling security teams to detect anomalies and incidents effectively. They provide a centralized view of an organization's security posture, combining various data sources and offering sophisticated correlation and monitoring tools....

Download Security Information and Event Management (SIEM) Report Read more