Our partners require such configuration as

  1. vulnerability scanner A (well-known in CIS area)

  2. SIEM B (leaders of the market)

And they should perform a scan of the network, get a report then forward it to the SIEM supposedly to challenge the findings against IOCs.

They insist to get the report into the SIEM -- we don't want to argue with them.

Does challenging the report against IOCs via SIEM sound right to you?

  • It is unclear what information they already feed into their SIEM. But it might well be that they correlate the information collected by the SIEM with the scan reports to get a larger picture of what need to be fixed and what might be false alarms. Thus if they already have a tool to do the job, then why add another one? Maybe the new tool is a bit better but it is still an additional tool which need to be learned and maintained, thus maybe adding more work instead of reducing work. Impossible to tell what's best based on the (lack of) detail in your question. Commented Dec 25, 2019 at 18:13
  • Where do you think the report should go?
    – schroeder
    Commented Dec 25, 2019 at 20:12

2 Answers 2


Feeding vulnerability reports into a SIEM is normal practice.

As for comparing data found by scans against IoCs, that too is normal practice. Where that is done (in a SIEM or not) really doesn't matter.


I would go the consultation way with them and ask them if they want the report verified against IoCs.

But most vulnerability scanners already have that integrated right? The ones I know like tenable for sure

Also good to get an agreement on which IoC feed.

What I have seen is that vulnerability scanners use alerts and send those to a siem

  • Welcome to the community. Have what exactly integrated?.. Commented Mar 12 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .