1

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference.

According to some research I've done about these terms SIEMs aggregate data from different sources and display them in a standardized manner to security analysts who sift through the data by hand. Advanced SIEMs are using Big Data technologies to identify user behaviours which the gathered data can be compared against. The last part seems to be the same definition as for the term 'Security Analytics'.

So are Security Analytics tools advanced SIEMs or something completely different?

|improve this question
1

SIEM is a tool, an object. Analytics is an action, a verb. The tool can contain the functions for actions (like analytics). The action is not a tool.

It is reasonable that tools for analytics do not aggregate or display alerts.

|improve this answer
  • So when a publication talks about Security Analytics tools, is it safe to assume the authors talk about SIEM solutions which incorporate Analytics technologies? – sherhol Feb 15 '18 at 14:57
  • @sherhol no - they mean tools that perform analytics. Those tools may or may not be part of a SIEM. – schroeder♦ Feb 15 '18 at 15:11
  • Now I'm confused. Don't analytics tools and SIEMs basically have the same functionality which is gathering data - except analytics tools automatically analyze data with big data technologies and data from SIEMs (without the analytics extension) are to be analyzed manually? – sherhol Feb 15 '18 at 15:18
  • 1
    All poodles are dogs, not all dogs are poodles. Analytic tools may not always include the functionality to gather data. SIEM tools also do not always have the function to gather data (they may sit on top of an existing data store). – schroeder♦ Feb 15 '18 at 15:20
0

A SIEM enables security analysts to perform security analytics. A SIEM performs the following:

  1. Parsing and normalizing of received log messages.

    For example, firewall vendor A uses the key src_ip to record the source IP address while firewall vendor B uses the key SOURCE in log messages. Standardizing the properties extracted from log messages does not only simplify searching and further processing, it is also efficient because regular expressions to extract data from log messages only need to be evaluated once.

  2. Automated security analytics by running configurable tests against the normalized log messages.

    For example, test and alert to indicators of compromise such as a print server beaconing to an external IP address.

  3. Enabling security analysts to perform manual security analytics, incl. reporting and compliance auditing.

    A SIEM allows easy searching and visualizing of the activities recorded in the log messages. This includes storing the normalized log messages while keeping them searchable in an efficient way, which is a challenge because of the massive amount of data.

In your question, you mention "user behaviours". I think it is debatable whether User Behavior Analytics (UBA) is an intrinsic part of a SIEM. Micro Focus ArcSight and IBM QRadar SIEM added UBA only two or three years ago.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.