One security manager's key questions for choosing a security information and event management product Mike Mahoney, manager of IT security and compliance at Liz Claiborne Inc., used the following evaluation criteria when choosing a SIEM product, eventually deciding on Q1 Labs’ QRadar. He asked several teams within the organization to rank these criteria in terms of their importance to getting their jobs done, both for statistical work (trending, historical, matrices and reporting) and for correlation (normalization and analyzing).Threat identification: Raw log form vs. descriptive.Threat tracking: Ability to track through the various events, from source to destination.Policy enforcement: Ability to enforce defined polices.Application analysis: Ability to analyze application at Layer 7 if necessary.Business relevance of events: Ability to assign business risk to events and have weighted threat levels.Measuring changes and improvements: Ability to track configuration changes to devices.Asset-based information: Ability to gather information on devices on the network.Anomalous behavior (server): Ability to trend and see changes in how it communicates to others.Anomalous behavior (network): Ability to trend and see how communications pass throughout the network.Anomalous behavior (application): Ability to trend and see changes in how it communicates to others.User monitoring: User activity, logging in, applications usage, etc.Mahoney also asked the teams to respond to the following questions:What devices would be candidates for log and event collection?What policies would you like to track?What information would you like to have available if a threat or vulnerability was identified?What sort of devices and information would be valuable for your area, in terms of asset collection?What length of time for access to current/archival information is acceptable?More on SIEM:What is SIEM software? How it works and how to choose the right toolArcSight vs. Splunk? Why you might want bothEvaluation criteria for SIEMSIEM: 14 questions to ask before you buyLog management basicsSIEMs-as-a-service addresses needs of small, midsize enterprises Related content news Google Chrome zero-day jumps onto CISA's known vulnerability list A serious security flaw in Google Chrome, which was discovered under active exploitation in the wild, is a new addition to the Cybersecurity and Infrastructure Agency’s Known Exploited vulnerabilities catalog. By Jon Gold Oct 03, 2023 3 mins Zero-day vulnerability brandpost The advantages and risks of large language models in the cloud Understanding the pros and cons of LLMs in the cloud is a step closer to optimized efficiency—but be mindful of security concerns along the way. By Daniel Prizmant, Senior Principal Researcher at Palo Alto Networks Oct 03, 2023 5 mins Cloud Security news Arm patches bugs in Mali GPUs that affect Android phones and Chromebooks The vulnerability with active exploitations allows local non-privileged users to access freed-up memory for staging new attacks. By Shweta Sharma Oct 03, 2023 3 mins Android Security Vulnerabilities news UK businesses face tightening cybersecurity budgets as incidents spike More than a quarter of UK organisations think their cybersecurity budget is inadequate to protect them from growing threats. By Michael Hill Oct 03, 2023 3 mins CSO and CISO Risk Management Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe