vulnerability scanner report to SIEM

Question

Our partners require such configuration as

And they should perform a scan of the network, get a report then forward it to the SIEM supposedly to challenge the findings against IOCs.

They insist to get the report into the SIEM -- we don't want to argue with them.

Does challenging the report against IOCs via SIEM sound right to you?

It is unclear what information they already feed into their SIEM. But it might well be that they correlate the information collected by the SIEM with the scan reports to get a larger picture of what need to be fixed and what might be false alarms. Thus if they already have a tool to do the job, then why add another one? Maybe the new tool is a bit better but it is still an additional tool which need to be learned and maintained, thus maybe adding more work instead of reducing work. Impossible to tell what's best based on the (lack of) detail in your question. — Steffen Ullrich, Commented Dec 25, 2019 at 18:13

schroeder · Accepted Answer · 2019-12-25 20:12:31Z

2

Feeding vulnerability reports into a SIEM is normal practice.

As for comparing data found by scans against IoCs, that too is normal practice. Where that is done (in a SIEM or not) really doesn't matter.

answered Dec 25, 2019 at 20:12

schroeder♦

132k55 gold badges307 silver badges348 bronze badges

Add a comment |

Acenl12 · Accepted Answer · 2024-03-11 21:52:40Z

0

I would go the consultation way with them and ask them if they want the report verified against IoCs.

But most vulnerability scanners already have that integrated right? The ones I know like tenable for sure

Also good to get an agreement on which IoC feed.

What I have seen is that vulnerability scanners use alerts and send those to a siem

answered Mar 11 at 21:47

Acenl12

11 bronze badge

Welcome to the community. Have what exactly integrated?..
– Sir Muffington
Commented Mar 12 at 18:13

Add a comment |

2 Answers 2