Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [siem]

Security Information and Event Management (SIEM) is a software solution that aggregates and analyzes activity from many different resources across your entire IT infrastructure.

Filter by
Sorted by
Tagged with
1 vote
0 answers
72 views

Security Incident Response Tracking [closed]

Besides Security IR tracking & workflow that is available in SIEM platforms, what are other tools that can do this such as standalone products like ServiceNow SIR or Everbridge xmatters? I found ...
Scott's user avatar
  • 160
2 votes
1 answer
173 views

Insights into SIEM logging for most data exfiltration scenarios

I would like some input from security professionals on the data exfiltration scenarios commonly executed by ransomware gangs. My area is system recovery & I am not knowledgeable about SIEM. I ...
eshcol dp's user avatar
5 votes
2 answers
1k views

Traditional SIEM in Kubernetes environments

How do companies manage SIEM for Kubernetes environments? I am specifically interested in running CIS benchmarks and auditing OS events on the nodes. I already have a Wazuh cluster and agents rolled ...
Lester's user avatar
  • 151
0 votes
2 answers
193 views

How do you detect attacks on Intel ME firmware and the AMD equivalent?

Since there are quite a few exploits of Intel ME firmware in the CPU (same applies to AMD), I would like to know what SIEM solutions are there for detecting these kinds of attacks. To be more exact, I ...
Sir Muffington's user avatar
2 votes
2 answers
107 views

Security Concern Opening Up Azure VM to AWS IPs

We have an IIS webserver hosted in Azure. We want to monitor this server via our cloud SIEM hosted in AWS. To monitor, there is a requirement to open outbound 443, on the VM, to a few hundred AWS ...
Nina G's user avatar
  • 133
0 votes
3 answers
839 views

Why would a legitimate application run on a non-standard port?

Among the many "threats", I see on my SIEM, a non-standard port is a top one. It's always been a false positive, but I don't understand why this happens frequently?
user270109's user avatar
1 vote
1 answer
2k views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
WWA's user avatar
  • 11
2 votes
0 answers
901 views

SVCHOST Executed without any arguements [closed]

Our SIEM has a Sigma rule that alerts when svchost is launched without any arguments. The logs are from a domain controller which unfortunately I don't have access to to verify. I will be reaching ...
faithsec's user avatar
2 votes
2 answers
340 views

Threat Hunting Vs SIEM use cases

Lately I'm confused about threat hunting vs SIEM Use case creation. The threat hunting resources I have read can be created as a SIEM use case. Then why should I perform it manually in the name of ...
Guru's user avatar
  • 21
0 votes
1 answer
381 views

Can SIEMs correlate logs from different sources?

Currently, there are too few ways to monitor security issues in the current company. Security solutions such as NDR, IPS, and WAF exist, but since there is no SIEM, the log must be checked on the ...
김남진's user avatar
0 votes
1 answer
151 views

Are sequential patterns used in practice?

I study computer security and I read articles about the potential usage of sequential pattern mining in IDPS products: Database intrusion detection using role and user behavior based risk assessment ...
inf3rno's user avatar
  • 489
1 vote
1 answer
145 views

SIEM-like tool for pcaps [closed]

Is there any tool that accepts a packet capture file as input and displays all the network traffic in a similar way to how a SIEM displays log information? I'm looking for a summary of the ports and ...
john doe's user avatar
  • 708
0 votes
1 answer
136 views

Can security devices (e.g. Snort, Splunk, WAFs, etc.) generate alerts when they aren't working as designed?

APRA's CPS 234 regulation section 56 states: An APRA-regulated entity would typically deploy appropriate information security technology solutions which maintain the security of information assets. ...
courtroomdrama's user avatar
1 vote
2 answers
494 views

What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?

I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
AndreaNobili's user avatar
0 votes
2 answers
934 views

Full packet capture vs SIEM

Instead of collecting various logs into the SIEM, can a full packet capture solution be better in terms of having to manage so many log sources?
JinPangPang's user avatar
  • 1,951
3 votes
0 answers
192 views

Essential / popular TAXII feeds [closed]

TAXII feeds are a great addition to a monitoring solution such as a SIEM. However, to my knowledge, there are only three distinct openly available providers: Hail A TAXII OTX Limo What other threat ...
Elhitch's user avatar
  • 413
0 votes
2 answers
185 views

How Vulnerability scanners assign CVE codes to Vulnerability found

I just want to know how CVE codes are assigned by the vulnerability scanners, while it found the particular vulnerability.
Ezekiel Kottarathil's user avatar
1 vote
1 answer
1k views

Where can I download sample security log file archives?

I am volunteering to teach some folks to learn Splunk to analyze logs by using SIEM. Therefore I will need some public log file archives such as auditd, secure.log, firewall, webapp logs, which I can ...
Blacklion's user avatar
2 votes
2 answers
3k views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
Jake Y's user avatar
  • 21
3 votes
2 answers
3k views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...
Eric's user avatar
  • 426
-5 votes
1 answer
266 views

SIEM false negatives [closed]

The company I work with has a SIEM which detects when you try to install any software in any workstation. If one of the employees try to install bad software, the SIEM triggers an alert. To circumvent ...
m.Robot's user avatar
1 vote
0 answers
559 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
md154199's user avatar
1 vote
1 answer
276 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons, e.g. via ssh/rdp, to associate the origin user and target user? My use case is to know who actually (personal/identifiable) used a technical ...
matcauthon's user avatar
1 vote
2 answers
663 views

Fortigate Creating Millions of DNS events to standard domains [closed]

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
Joe's user avatar
  • 172
4 votes
2 answers
2k views

Datasets dedicated for SIEM systems [closed]

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
U. User's user avatar
  • 190
0 votes
1 answer
209 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
ficabj5's user avatar
  • 23
1 vote
1 answer
822 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
Curious Analyst's user avatar
3 votes
2 answers
1k views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
Sun-IT's user avatar
  • 33
0 votes
1 answer
343 views

What is the future of SIEM tools? [closed]

Do SIEM tools have a future or will everything move to 100% automation? Will an analyst need to monitor and analyse the collected data in the future or will this be automated? How will SIEMs tools be ...
kanthraj's user avatar
0 votes
1 answer
1k views

How to detect webshell [closed]

I implemented an SIEM and right now looking for solutions to detect webshell upload to IIS and Apache web servers. What are the requirement for detecting webshell upload?
ali tavakoli's user avatar
3 votes
4 answers
947 views

SOC and generic log parsing

I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
Hilo21's user avatar
  • 33
2 votes
0 answers
458 views

How can XML External Entity attacks be detected?

XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
ellefc's user avatar
  • 529
7 votes
4 answers
23k views

What is the difference between a SIEM and a SOC?

What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)? Do they work together? And if independent when to use which?
whatever489's user avatar
0 votes
3 answers
352 views

What is the difference between Compliance and Auditing in Information Security?

I am a student working on my semester project and it's about developing a SIEM solution with Big Data tools to be used in a SOC (security operations centre) and I know that collecting logs can be used ...
Hilo21's user avatar
  • 33
1 vote
0 answers
176 views

Machine reaching out to Microsoft IP address using NBTstat command

I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address. Should UDP 137 ever reach out externally? This is about all the ...
Kajunga's user avatar
  • 11
-3 votes
1 answer
683 views

What architecture for a SIEM based on an ELK cluster? [closed]

First thoughts to build a SIEM based on ELK, inside a multi-locations company : All assets send their log to Logstash locally (for each location) ElasticSearch stores the logs locally after Logstash ...
lalebarde's user avatar
  • 617
1 vote
0 answers
864 views

Does an ELK based SIEM need a correlation engine? [closed]

We want to build a SIEM with an ELK stack, for a multi sites software company (10 locations, 10k people). Is a security specific correlation engine recommended or is it unnecessary? As possible ...
lalebarde's user avatar
  • 617
1 vote
2 answers
458 views

SIEM and Security Analytics

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference. According to some research I've done about these ...
sherhol's user avatar
  • 13
1 vote
0 answers
204 views

Splunk integration with HoneyD [closed]

In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk. I am very interested in how to integrate HoneyD with Splunk, it ...
Ben's user avatar
  • 11
7 votes
2 answers
2k views

How do I track bash history cleanup?

I'd like to catch events when bash history is cleaned or some lines are deleted. Are there any best practices or auditing tools with this capability?
inx's user avatar
  • 71
5 votes
2 answers
722 views

Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]

You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...). You also setup some rules so that some event triage is ...
Sas3's user avatar
  • 2,658
2 votes
1 answer
1k views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
LUser's user avatar
  • 846
0 votes
1 answer
189 views

Do SIEM appliances perform similar tasks to non-commercial anti-malware software? [closed]

First of all, let me apologise if this is considered an ignorant question. I'm new to the concept of SIEM and have been asked by my new employer to familiarise myself with the subject. I understand ...
RoyalSwish's user avatar
1 vote
0 answers
131 views

Would extracting logs from a European server to a US SIEM system cause privacy legal concerns?

Looking for an answer related to the European "General Data Protection Regulation." laws.
Kamic's user avatar
  • 693
7 votes
2 answers
1k views

SIEM: Monitoring End Users and DHCP IP assigning issue

I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with ...
Bilal Ahmad's user avatar
0 votes
1 answer
3k views

Difference between audit log failure/success?

I am working on event logs. I receive different logs such as 1. Success audit 2. Failure audit For same type of events(Login,logoff) etc. What exactly is the difference between these two types of ...
Vatsalya Yadav's user avatar
0 votes
1 answer
423 views

Do we need to include SIEM hosted in the cloud in CDE scope for PCI DSS requirement..? where no CD or transacation logs are being process or managed

We have our cardholder data environment (CDE) hosted in on-premise model (private datacenter), except SIEM solution is implemented for logging and monitoring in private cloud. where we are forwarding ...
bharathidasann's user avatar
2 votes
2 answers
770 views

Detect a Host on my Network that is Conducting Web Scraping on External Systems

It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, ...
Zane's user avatar
  • 73
0 votes
1 answer
347 views

Attack from different blacklisted IP which belongs to different GEO location [closed]

Attack from different blacklisted IP which belongs to different GEO location although source MAC address is same. Why?
Nishit Dholakiya's user avatar
1 vote
1 answer
1k views

Are SIEM and NIDS/HIDS complementary?

I just would like to have your feedback if you were involved with Security Information and Event Management. From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)...
phackt's user avatar
  • 11