When deploying an SIEM solution, what is the best practice when classifying the severity of each event that is being sent from individual devices?

I understand that this may be a little bit subjective and depending on the organization's monitoring objective but is there a starting point or common practices on how to classify the severity of messages?

2 Answers 2


This will entirely depend on what your goal is. Generally you need to classify the severity based on the threat of business continuity. First of all categorize per type and subcategorize:

  • Security Events => external, internal

  • Availability => hardware ( disk arrays, batteries going bad, chassis open...), software (Is the http service still available, what is the response time, what are our machines using in resources, ...)

Then for each subcategory you decide the criticality of each event yourself, keeping in mind: "What threat does this event pose for our business continuity". You could differentiate with:

  • Low (Warning, but no direct impact if problem increases, a failing)
  • Medium (Warning, but has impact if problem increases)
  • High (Danger, system is close to becoming unavailable)
  • Critical(System is down or business critical systems are close to failing)

For security events this could be the same. For instance, an external port scan might be a medium risk, you need a warning, but it's probably just internet noise, whereas a port scan coming from the internal network is a lot more worrying.

  • Hi @Lucas Kauffman. Thanks for your input. However, I don't quite get the idea of classifying severities based on business continuity. Business continuity, I believe focuses more on 'worst case scenario'. As such, how do we classify those in between? Taking a web server as an example, we can easily classify the unavailability of httpd service as critical. But what about an attacker performing NULL scan to find closed ports? Under what severity should we place them? Would you care to elaborate on them?
    – NAT3863
    Commented Nov 1, 2013 at 18:50
  • Also, most of the SIEM automatically classifies severities of each messages. Is it 'okay' to rely on these default severities classification? Thanks!
    – NAT3863
    Commented Nov 1, 2013 at 18:52
  • Well, it depends what the webserver does, if the webserver is used intensively by your personel, it's quite critical to get it back up and running, but if the webserver is used in QA, test or dev, it might not be something you need to fix NOW (because it's not being used). Now a port scan will normally happen every once in a while on the external facing systems. This is something which will happen often. But if you have a portscan on your internal network, it might be a lot more worrying because then someone is doing something malicious on your internal network. Commented Nov 1, 2013 at 18:57
  • Well most products indeed come with standard classificiation, but you can fine tune this to get a better input to your automated ticketing system to classify what needs to be fixed now and what can be fixed later. Commented Nov 1, 2013 at 18:58

There are a number of initiatives in the works to make this easier for companies to define. But it all depends on the individuals to define what is important to them.

Some frameworks include:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .