As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking something that combines the combined wisdom of COBIT, PCI, etc. in a way we can present to other departments.
migrated from serverfault.com Aug 8 '11 at 19:30
This question came from our site for professional system and network administrators.
This is a mind-blowingly huge question. What you need to log is business specific need. Typically, you want to log administrative logins and changes. But still that is pretty basic. What you need is a better understanding from the people who drive you organization on what systems are important. A good business continuity plan with some risk assessments will drive you far.
I am realistic, and I know that getting that is probably a non-starter. So can I offer this, if you are trying to tune your SIEM product, don't just slam everything in there at once. Pick something, like Network Switches and get those sending logs and tuned up before you move onto the next thing, say Domain Controllers.
You want your SIEM to only be notifying you of a problem, if you are inundated with 400 alerts per day, your SIEM tool is almost worthless and you should've just deployed a syslog server and saved a bunch of cash.
Here's a simple answer: Log everything.
Everything that can be captured, send it along to your SIEM server. Your focus should be on selecting and implementing an SIEM server that can handle that volume of data and can be used for alerts and reports that provide meaningful security-related information without too many false positives.
You should not focus on determining what is or isn't important and squelching messages at the source. If you're wrong, then when you need the data, it'll be gone or scattered out at the endpoints, with the only copies on possibly compromised machines.
If you gather everything to your central SIEM, then you've got a forensic copy in case an endpoint machine is compromised. Where you would have had to tune which logs to forward, now you only have to tune which logs to process for your alerts and reports. And if it turns out that you needed something you thought unimportant, then you have it, right there and ready for the centralized searching that SIEM provides.
The downsides are:
The upsides are: