# SIEM Solutions - Vendors

#### **1. Overview of SIEM Solutions:**

* **SIEM (Security Information and Event Management)** solutions help in analyzing security event data in real-time, supporting early detection of attacks and breaches.
* These tools are used for collecting, storing, investigating, mitigating, and reporting on security data, essential for incident response, forensics, and regulatory compliance.

#### **2. Gartner's Magic Quadrant:**

* Vendors like **IBM QRadar, Splunk, Exabeam, LogRhythm, and Rapid7** are positioned in the Magic Quadrant for their robust SIEM solutions.
* The discussion focuses on IBM QRadar, Splunk, Exabeam, and LogRhythm.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2Fh4HeCESq9NwqaobVJKDz%2Fimage.png?alt=media&#x26;token=b0caa5ed-38be-47e9-8ba0-865eabad4937" alt=""><figcaption></figcaption></figure>

#### **3. Deployment Sizes:**

* **Small Deployment:** Around 300 log sources and 1500 Events Per Second (EPS).
* **Medium Deployment:** About 1000 log sources and 7000 EPS.
* **Large Deployment:** About 1000 log sources and 15,000 EPS.
* **Flows:** Communication between devices on a network is also crucial, though not all SIEM solutions handle them effectively.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2Foo3GkjltHRuEWW7Qsesa%2Fimage.png?alt=media&#x26;token=0376e0c7-2787-491f-bede-45a1ccf7af2c" alt=""><figcaption></figcaption></figure>

#### **4. SIEM Concepts:**

* **Rules:** Procedures that correlate events into a report or incident.
* **Rule Threshold:** Point at which the rule is triggered.
* **Event Threshold:** Number of times an event must occur before triggering a rule.
* **Rule Action:** Procedure that occurs when conditions and thresholds are met.
* **Trends:** Define how and over what time data will be aggregated and evaluated.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FI01xzaWZLfsCQzQzasu8%2Fimage.png?alt=media&#x26;token=1995ef15-ea71-426c-b16e-84dd9fde24ca" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FQBxoJcvNM5dEA45Badt9%2Fimage.png?alt=media&#x26;token=70f2a1e1-e1f2-485c-bae6-7639f34babeb" alt=""><figcaption></figcaption></figure>

#### **5. Data Collection and Normalization:**

* **Data Collection:** Process of collecting flows and logs from various sources.
* **Normalization:** Raw events are turned into readable fields like IP addresses, making them easier to analyze.

#### **6. IBM QRadar:**

* **Components:** Vulnerability Manager, User Behavior Analytics, QRadar Network Insights.
* **Focus:** Started with network behavior anomaly detection.
* **Differentiator:** Focuses on flow data, which is not natively handled by most SIEM solutions.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2F1ectsXkSIWuol23hsn2T%2Fimage.png?alt=media&#x26;token=d70a1503-77d3-42fc-8dee-93c9f794f577" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2Ff4DvDw0fjzdXOeQT87tk%2Fimage.png?alt=media&#x26;token=eb4f90bd-e6f3-40ae-a5fc-9ffffa3b3a88" alt=""><figcaption></figcaption></figure>

#### **7. ArcSight:**

* **Components:** ArcSight Manager, CORR-Engine, Console, Command Center, APIs.
* **Focus:** Event correlation and security analytics.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FziX1T4I1QTMuOQwt2JEX%2Fimage.png?alt=media&#x26;token=88a9a837-66c9-4bf0-ba76-bb615f1cc250" alt=""><figcaption></figcaption></figure>

#### **8. Splunk:**

* **Unique Value Proposition:** Operational intelligence, aiming to make machine data accessible and usable.
* **Architecture:** Data collection, indexing, and presentation layers.
* **Growth:** Initially not a SIEM, but expanded into the SIEM space.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FAv75NltKIDbv2gHoq8Te%2Fimage.png?alt=media&#x26;token=cdf81f9f-7cba-4d4d-a5f8-b3a5dc634193" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FJ0cOhoD4fQavo3jJeWVj%2Fimage.png?alt=media&#x26;token=923ce1a1-8351-4fdc-ad26-b7c363a08c81" alt=""><figcaption><p>Friendly Representation of Splunk Services</p></figcaption></figure>

#### **9. LogRhythm:**

* **Components:** Platform Manager, Data Processor, Data Indexer, AI Engine.
* **Focus:** Centralized management, network monitoring, and deep analysis of network traffic.
* **All-in-One Appliance:** For smaller implementations, combining all solutions into a single appliance.

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2FOJ8b8qGV9YeVN8xIbZFl%2Fimage.png?alt=media&#x26;token=e18e0064-b1f7-4864-b642-40a96423f57a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4123568914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FgelFCpcXVyNKWg0n0zQi%2Fuploads%2F1fcmKU1dipVLbyOPlW8X%2Fimage.png?alt=media&#x26;token=a30b6abf-d965-44a3-bc82-0ebc2649a7bb" alt=""><figcaption></figcaption></figure>
