Evaluating and Purchasing a SIEM Solution
The security software market has been dominated by Security Information and Event Management (SIEM) solutions for nearly two decades. Despite their widespread adoption, there is still a lack of comprehensive information on how to evaluate and manage these vendors effectively. In this article, we will provide six top-line tips for procuring and implementing a SIEM solution that delivers maximum value.
1. Size Your Spend
SIEM software solutions are priced differently by various vendors. Some charge based on the number of employees in the customer organization, while others base their pricing on the rate of events per second or log volume ingested. It is essential to determine the pricing model used by your chosen vendor early on to get a rough estimate of what you will pay over time.
To size your spend, identify the various data sources meaningful to your Security Operations Center (SOC). If you already have a SIEM in place, provide the vendor with your current use cases and consumption. They should be able to replicate it. However, if you don’t have an existing SIEM solution, you will need to do some legwork.
Assessing Log Volume
A good starting point is assessing the volume of logs you’ll send to the SIEM. Measure actual daily log volume from each source by checking out locally stored logs for a ‘normal’ day and tallying the results. This will help you determine the cost implications of your chosen vendor’s pricing model.
Avoid Employee-Based Pricing
If the SIEM vendor charges based on the number of employees, be wary. This is often a way to charge more for fewer users, as companies typically have multiple departments with varying levels of IT maturity.
2. Conduct an Evaluation that Exercises All Aspects of the Vendor’s SIEM Practice
Conducting a thorough evaluation of the vendor’s SIEM practice will help you determine whether their solution meets your organization’s specific security needs. The evaluation should include exercises for:
- Data collection and processing
- Alert detection and notification
- Incident response and management
This comprehensive approach will enable you to assess the vendor’s ability to provide accurate threat detection, streamlined incident response, and enhanced visibility into IT infrastructure.
3. Capture All Costs of Implementation
When evaluating a SIEM solution, it is crucial to consider all costs associated with implementation, including:
- Hardware and software requirements
- Integration with existing systems (e.g., firewalls, intrusion prevention systems)
- Training and support
Don’t be surprised by hidden fees or unexpected expenses that can arise during the implementation process.
4. Prioritize Your Data Sources and Prepare a One- to Two-Year Plan for Ingesting Data
Prioritizing your data sources is essential when implementing a SIEM solution. Determine which sources are most critical to your organization’s security posture and develop a plan for ingesting this data into the SIEM platform.
A one- to two-year plan should be developed, outlining milestones and timelines for ingesting data from each source. This will help ensure that you’re collecting relevant data in a timely manner, enabling more accurate threat detection and response.
5. Thoroughly Document SIEM Workflows and Runbooks
Documenting SIEM workflows and runbooks is crucial for maintaining consistency and reducing errors during incident response. Develop detailed documentation outlining:
- Data collection and processing procedures
- Alert detection and notification processes
- Incident response and management protocols
Regularly review and update this documentation to ensure it remains relevant to your organization’s evolving security landscape.
6. Establish Quarterly Meetings with Your Vendor’s Executive Team
Establishing regular communication with the vendor’s executive team will help you stay informed about product updates, service improvements, and commercial changes that may impact your organization.
Meet quarterly to discuss outstanding issues, align on strategy, and capture feedback from both parties. This open dialogue will foster a stronger partnership between your organization and the SIEM vendor.
Summary
To maximize ROI from your SIEM investment, follow these six top-line tips:
- Carefully prepare for your evaluation with a comprehensive sizing exercise.
- Conduct an evaluation that exercises all aspects of the vendor’s SIEM practice.
- Capture all costs of implementation.
- Prioritize your data sources and prepare a one- to two-year plan for ingesting data.
- Thoroughly document SIEM workflows and runbooks.
- Establish quarterly meetings with your vendor’s executive team to address outstanding issues and align on strategy.
By following these guidelines, you’ll be well-equipped to select the right SIEM solution for your organization, ensuring that you’re maximizing security visibility while minimizing costs.
