This article is part of an Essential Guide, our editor-selected collection of our best articles, videos and other content on this topic. Explore more in this guide:
2. - SIEM operational best practices: Read more in this section
- SIEM best practices for advanced attack detection
- Why focus on SIEM integration, coverage maximizes anomaly detection
- Exploring SIM architecture options for virtual data center security
- Should IDS and SIM/SEM/SIEM be used for network intrusion monitoring?
- Securing the SIEM system: Control access, prioritize availability
Explore other sections in this guide:
Generally speaking, a SIM/SEM/SIEM network intrusion monitoring system is an enhancement to an existing IDS. It will store and further process the logs generated by the IDS and allow you to correlate IDS entries with other security events, such as vulnerabilities detected by a network scanner. The use of a SIM/SEM/SIEM can greatly reduce the amount of time spent reviewing log records by automating the task.
That said, SIM/SEM/SIEM devices are expensive. If you don't have the budget to purchase a good SIM/SEM/SIEM, you're probably better off doing network intrusion monitoring yourself than installing a marginal quality SIM/SEM/SIEM. Less sophisticated systems integrate with fewer of your security devices, require more extensive configuration and maintenance and will probably increase the total cost of ownership.
You shouldn't lose any data between your IDS and your SIM, but it's always a good idea to monitor log data and keep IDS logs as a backup in the event the SIM malfunctions or becomes unavailable.
For more information:
- Learn how to mine enterprise SIM logs for relevant security event data.
- Don't have a SIM? Find out how to check for attack data on network logs without SIMs