Transcript

SIEM Trends · CYBR.Signal

0:00
SPEAKER_00: And hello everybody, happy Cyber Sunday.
0:02
SPEAKER_00: Hope you're doing well.
0:03
SPEAKER_00: So today I want to talk about SIM, S-I-E-M, Security Incident and Event Management, however you want to pronounce it, SIM SEAM.
0:11
SPEAKER_00: It's all an acronym Soup out there these days, anyway.
0:14
SPEAKER_00: So seeing some trends, I think they're fairly obvious out there, but kind of wanted to get them out of my brain.
0:21
SPEAKER_00: So I did some training this week with a vendor that is like an XDR extended detection and response vendor.
0:29
SPEAKER_00: Got a platform, got a lot of different products.
0:31
SPEAKER_00: Also did some training and some uh had a conversation with um some analytics vendors that are kind of getting taking the analytics engine and separating it from the SIM.
0:47
SPEAKER_00: And so there's two of those kind of like trends in which the question I have is which way you know you're thinking is either going to win or if either one of them are gonna win.
0:56
SPEAKER_00: But basically the trends are you have a sim and you use that really as your what it used to be is you tried to create your analytics engine on that, did all your correlation, all your rules, did all that stuff.
1:11
SPEAKER_00: And sims have just proven not to be the strongest for that in a lot of ways.
1:16
SPEAKER_00: Um, so what you had is people with a desire to pull all of the data that they needed to collect, all the telemetry they needed to collect, put that in some kind of data lake, and then use these external analytics engines like Anvil Logic, like Hunters, like Securonics, there's others.
1:32
SPEAKER_00: Put that on top of that.
1:35
SPEAKER_00: That way you've got the analytics running there, and you don't have a sim lock-in.
1:39
SPEAKER_00: You can, you can use, you don't even have to have technically a sim.
1:43
SPEAKER_00: You can just have some kind of data lake that's has strong search capabilities, can collect fast from all kinds of different data sources.
1:50
SPEAKER_00: And now you got stuff like Cribble that even solves some of that problem where it can put it anywhere.
1:55
SPEAKER_00: So that's your one trend where you've got that analytics engine on top and you don't have a lock-in to a particular SIM.
2:01
SPEAKER_00: And you can change that backend out for your data store however you want to.
2:06
SPEAKER_00: The other way I'm seeing it, which is what I was talking about, was the XDR vendor, is a platform.
2:10
SPEAKER_00: They're these XDR extended uh detection response vendors are creating a platform with multiple different products within their platform.
2:19
SPEAKER_00: They already pull in telemetry from those different products and do analytics with something they've got on the back end.
2:29
SPEAKER_00: And and one of the biggest ones out there, um, I won't say who they are, but I think most people will know by this, is that they've gotten rid of Splunk as their back end and they've used they've bought a log aggregator, log um, you know, collection engine, and that's really, really good, and they've moved over to that, and they're doing all their analytics on that.
2:52
SPEAKER_00: And the and they knew, and there's a couple of platform players that are doing this, um, they knew that they would be limited at some point because not everybody's gonna buy just all of their tools.
3:05
SPEAKER_00: So they have this XDR concept where they start pulling in tow inventory from third parties and start actually doing analytics on those.
3:13
SPEAKER_00: So that's kind of the two trends that I'm seeing.
3:16
SPEAKER_00: Again, just to summarize, either people don't want to have a sim lock-in and they want to be able to be flexible with their back-end data store, and then they they want one that's strong, can do all kinds of searches with it, very fast, easy to pull in data, absorb that data, but then have an analytics engine on top, or you've got a kind of a platform play where you've got an XDR that is able to pull in telemetry from a lot of different stuff and their own stuff.
3:45
SPEAKER_00: But what you have then is you're locking into their SIM, and a lot of a lot of them are calling it next gen sim, but they're you you're locked into theirs, so you don't have as much flexibility in the data store.
3:58
SPEAKER_00: So the question is, you know, what do you see?
4:00
SPEAKER_00: Maybe if you want to answer this, what do you see as the trend?
4:02
SPEAKER_00: What do you think is gonna win out?
4:04
SPEAKER_00: Or do you think like I do, where you're not, and this is a conversation I was having with my uh coworker Mark Butler.
4:11
SPEAKER_00: Is it tends to be that nobody's gonna have one or the other?
4:16
SPEAKER_00: There's tends to be so many different data stores out there already that they can't easily pull from one to replace it with another.
4:24
SPEAKER_00: Um, it's just not an easy use case.
4:28
SPEAKER_00: So they end up with multiples of these solutions, at least two or three.
4:33
SPEAKER_00: And it's just a more practical solution is you fit where you can to get efficient, or you fit one of those either way you go into one of the situations that you make it more flexible for you, and then keep using what you had before.
4:47
SPEAKER_00: Um, in another area that it's just not as easy to just you know lift something out and put something else back in.
4:54
SPEAKER_00: So just something I want to get out of my brain.
4:56
SPEAKER_00: Let me know what you think about it again.
4:57
SPEAKER_00: Summarizing it one more time.
5:00
SPEAKER_00: Do you see it, the trend winning out where people are using data stores, different data stores, and have analytics on top of it so they don't have a sim lock in?
5:09
SPEAKER_00: Or do you see people going more with a platform play and using an XDR that has an X gen sim that allows you or that locks you in, but it still allows you to create or pull telemetry and do analysis um on multiple different data sources, or do you see it kind of being a combo of both, which is I think the more practical thing?
5:27
SPEAKER_00: So let me know what you think.
5:28
SPEAKER_00: Talk to you next time.