SIEM, SOAR and Security Event Monitoring

What it is

Security monitoring is the daily work of watching for signs that something is wrong.

A large network produces millions of events a day, far more than a person can read. So organisations use tools to collect events in one place, find patterns, and raise alerts for people to examine.

This page covers the two main tools, SIEM and SOAR, the data they watch, and how to decide when a problem needs to go to someone more senior.

How it works

Data flows into a central tool, the tool picks out what matters, and people or playbooks respond.

SIEM

SIEM stands for security information and event management. It is a platform that gathers log data from many sources and helps analysts see the whole picture.

A SIEM typically does these jobs:

• Collects logs from firewalls, servers, endpoints, applications and security tools
• Normalises them, which means converting different formats into one common layout
• Correlates events, which means linking separate events into one story
• Alerts when rules or patterns match
• Stores logs for searching and for later investigation or audits
• Shows dashboards and reports

Correlation is the key idea. One failed login is normal. Fifty failed logins on one account from one address, followed by a success, is a pattern that needs attention.

SOAR

SOAR stands for security orchestration, automation and response. It works with the SIEM and other tools to carry out routine response steps automatically, using playbooks, which are step by step workflows.

For example, when a SIEM reports a phishing email, a playbook might look up the sender, check the link reputation, remove the message from other mailboxes, and open a ticket. A person is only pulled in when a human decision is needed.

SOAR saves time, makes responses more consistent, and lets analysts focus on difficult cases. It does not replace people.

Network data that is monitored

Analysts rely on several kinds of data.

A packet capture gives the most detail, but it is large and costly to keep, so it is used for targeted investigation. Logs are smaller and are kept for longer.

Mar  3 02:14:07 fw1 %ASA-4-106023: Deny tcp src outside:203.0.113.9/51022 dst inside:10.0.0.5/22 by access-group "OUTSIDE_IN"

This example is a Cisco ASA firewall log line. It shows a denied connection attempt from an outside address toward port 22 on an inside host. A single line like this is routine, but many of them from one source would suggest a scan.

Identifying suspicious events

Examples of suspicious events are:

• repeated failed logins, or a login from an unusual place or time
• a device contacting a known bad address
• a sudden large upload of data
• unusual traffic on odd ports, or a large number of DNS requests
• security software disabled, or logs cleared
• a new account or privilege change that nobody requested

Compare what you see with a baseline, the normal behaviour for that network. Events that differ strongly from the baseline deserve a closer look.

An event is anything that happens. An incident is an event, or group of events, that harms or threatens the organisation's security. Most events are harmless, and analysts triage them, which means sorting by importance.

Escalation

Escalation means passing a problem to a more senior person or team when the first analyst cannot or should not deal with it alone. Typical reasons are:

• a confirmed compromise of a system or account
• sensitive or regulated data may be involved
• the issue affects many systems or critical services
• the analyst lacks the authority or skill to act
• the incident meets a severity level set by the policy

Follow the written procedure, record what you found, and keep the evidence safe. Escalate early when in doubt, since a late escalation can cost more than an early false alarm.