Senior Network Security Engineer with 201-500 employees
10 December 19
I look at the attack analysis, which shows me which attackers try to exploit my vulnerabilities. I can check the ticket to see if it's blocked or whether it's a false positive. Whatever the case, if it already exists, I will block it. McAfee IPS has a benign engine, so this may not be a target in your environment. If you just prevent attackers from using it, they will try another vulnerability. I have physical routers, but they try to make some novel vulnerabilities. This is not applicable to my environment, so when I see this alert I know it's a false positive not related to my environment. In some cases, I change the action of these alerts or attacks to block. This is what happened in one of the use cases I take advantage of from IPS. I got an alert about some attacks in my environment, regarding the SPAN port and server traffic. I saw it and I detected the source point of this attack.
The right SIEM tool varies based on a business’ security posture, its budget and other factors. However, the top SIEM tools usually offer the following capabilities:
Scalability — Ensure the solution has the capability to accommodate the current and the projected growth.
Log compatibility — Ensure that the solution is compatible with your logs
Correlation engine — Does the solution have th...
IBM Security, European Threat Management Sales Leader at IBM
11 May 21
Having the SIEM as a central feeder is a traditional solution architecture. The question can be asked , do I have the right security platform ?. As the interconnections to this traditional centralized solution will always need maintaining. In the case of a Security platform this effort is removed.
Senior Network Architect / Network Team Leader at ICE Consulting. Inc.
12 May 21
A good Security Platform includes SIEM, UEBA, NTA, and SOAR! on a single pane of glass, but I agree all security platforms require constant maintenance to remain viable as a part of the security posture!