5 Tips to Maximize Your SIEM/SOAR Capabilities
Sivan Tehila, co-authored by Jacob Leichter
While cybersecurity demands a lot of human input, there is only so much that the security teams can handle on their own. This is especially true in larger organizations with a more extensive architecture. Limited staff, burnout, and potentially missing key details in huge swaths of data are all unfortunate realities in this industry. Leveraging technology to do some of the heavy lifting is a boon for security teams and can ease some of their burdens on the job. A solution that has already cemented itself into the core set of security tools is SIEM, with SOAR solutions emerging as a more versatile option.
Security Information and Event Management, or SIEM, analyzes networks and collects data on observed activities. These logs are presented in an easily digestible format on a central console, making the process of parsing through the data and prioritizing issues much simpler. Practitioners can use the SIEM findings to develop robust incident response plans and to mount responses to reported incidents. Security Orchestration, Automation, and Response, SOAR for short, does everything that a SIEM solution can, with the added benefit of integration with other tools to facilitate smoother, more immediate response strategies.
The best practice, where possible, is to combine the two. The SIEM tool can monitor the network and send logs to the SOAR solution, which can then use artificial intelligence and its integrated applications to generate a rapid response. Regardless, a SIEM or SOAR on its own can provide excellent results and be an invaluable asset to any effective security infrastructure. Here are five tips for organizations looking to introduce either, or both, into their new or existing architecture.
1. Determine Critical Systems
SIEM and SOAR tools function like an extra set of eyes for security teams, collecting network activity logs for staff to review. These monitoring solutions are meant to help security practitioners in their roles. However, if too much data is gathered, analysts will still be overwhelmed chasing down potential false flags. They may even miss actual incidents due to the sheer number of reported events, something that could have catastrophic results.
Instead, take the time to identify critical assets in the enterprise architecture. Prioritize elements that may receive the most attention from threat actors, such as storage locations for highly sensitive corporate and customer data, endpoints with administrator-level access, or devices that are essential for business operations. Position the SIEM and SOAR to focus on these assets. This way, if an attempted breach is discovered, it can be caught quickly and before any successful data exfiltration or disruptions can occur.
2. Develop Incident Response Plans
SIEM and SOAR tools may send alerts of suspected incidents. But what then? An alert is only as good as the reaction to it. Before establishing these monitoring and logging solutions on the network, it is important to have a proper response plan in place to guide the team in what to do when the SIEM flags suspicious activity. These incident response playbooks should outline the first steps to take, who to notify, and available resources for that initial response, to name a few of the key elements.
In the case of SOAR, these solutions can deploy automated responses to potential events. How they respond depends on the configurations set by the analysts running the tool. If the organization uses a SOAR system, then the playbook should describe the role that automated response tools will play. Having a clear plan that leverages the automation of a SOAR tool effectively can play a crucial role in containing events before they get out of hand.
3. Focus on Threats, Not Alerts
Alerts are fired off for all detected incidents. A downside of automated tools is false positives, where the system detects seemingly suspicious, but perfectly okay, activities and flags them as a reportable incident. This can occur, for example, when a low-level user is temporarily granted access to privileged data for a specific task. Chasing down all of these alerts, especially ones that lead nowhere, is exhausting and a waste of resources.
Instead of concentrating on alerts, take a threat-centric approach for increased efficiency. Configure the SIEM or SOAR to look for threat signatures, rather than individual incidents. Two isolated events on the network may seem separate from each other, but could, in actuality, be part of the same issue. For example, if a user receives a suspicious email and a company executive is sent an odd text message, the SIEM or SOAR solution will flag them as two unique things; it may be one threat actor targeting two individuals to find a point of entry.
4. Introduce the Tool Slowly
As should be the case with any new implementation on the enterprise architecture, the introduction should be done deliberately and slowly. Roll out the SIEM or SOAR solution on a small-scale basis and within a limited section of the network. If possible, test the tool in a sandbox environment to prevent any unintended effects to the actual infrastructure. Once the initial setup is complete, the SIEM or SOAR should still be released across the network in stages, so that any issues can be reverted without causing widespread problems
Doing this allows security architects to observe how the tool interacts with existing elements on the architecture. Necessary configurations for different environments can also be made with staged releases, as a setup that worked in a sandbox may not translate well in the real scenario. A slow introduction minimizes the risks of system-wide issues during the launch of the monitoring tool.
5. Adjust as Needed
This last tip may seem obvious but is often forgotten over time. Nothing is ever perfect, especially not at the onset. When deploying a SIEM or SOAR tool, check its performance and ensure that it is functioning optimally and in the required fashion. Audits should be conducted periodically to verify these two aspects. This is perhaps most important following any modifications to the enterprise architecture, like when new elements are added into the network.
Reevaluate the business needs and reconfigure the SIEM or SOAR functions as needed. With the frequent changes to the cybersecurity landscape, this is a necessity. Monitoring and logging tools, particularly ones with automated response capabilities, should be updated with the latest signatures regularly. If the organization’s threat landscape shifts, they should be repositioned to defend more vulnerable parts of the network.
There are many excellent automated tools that can help enhance the security posture of a network and take some of the load off of the human elements involved in security. SIEM and SOAR solutions are two options that provide monitoring, logging, and, in the latter’s case, rapid response to detected incidents. This puts both as part of the fundamental, core components to a cybersecurity infrastructure. That said, they only work well if they are implemented properly. The tips provided here are a good starting point for introducing either a SIEM, a SOAR, or both onto a network architecture.