Do SIEM tools have a future or will everything move to 100% automation? Will an analyst need to monitor and analyse the collected data in the future or will this be automated? How will SIEMs tools be in the future?

  • This question is too broad and undefined and requires a lot of speculation. How far in the future? Is there an alternative to SIEM that you are thinking about? Can you narrow the question down at all?
    – schroeder
    Commented Aug 7, 2018 at 18:59
  • SIEM does not have a future and here is why, 1) SIEM killers, such as Chronicle Security's Backstory product, 2) Big Data and SIEM do not work, nor scale long-term. Automation is not the answer for SIEM, nor Security Operations. Security Operations must/will move to a NCWF model, where current/modern aspects are broken down to more-granular roles and functions. This has already started and will take about 5 years to go fully mainstream.
    – atdre
    Commented Mar 6, 2019 at 19:43
  • The tools we use for SIEM today will be replaced by platforms such as AWS Kinesis (or LogStash-like mechanisms) filtered to Spark Structured Streaming with Spark SQL ETL pushing DataFrames to Parquet files on a structured DFS or S3 (or S3-like). Spark Structured Streaming will also push out to an alerting engine that looks a lot more like streamalert.io and a lot less like commercial SIEM/SIM we've known for 2 decades now.
    – atdre
    Commented Mar 6, 2019 at 19:45

1 Answer 1


Does SIEM has future


like is it going 100% automation


like an Analyst need to monitor and analyse?

Yes, but hopefully less than they do today.

Or how the SIEM tools will be in future?

More automated analysis, but still reliant on humans to discriminate between false and true positives.

Not the answer you're looking for? Browse other questions tagged .