Do you have recommendations for the best SIEM tool to invest in for a large financial services provider? What particular features of your recommended tool make it the best choice?
First off, look for a SIEM that offers customized content for financial services. Use cases such as SWIFT fraud, insider threat and data exfiltration, trade surveillance are the sort of support you should be looking for.
I work for Securonix, and our solution has content tailor-made for the financial services industry. Specific financial services firms may have different requirements, but our prebuilt content provides broad coverage. Needless to say, I would recommend Securonix, but one aspect to consider with any solution - for financial services, the creation of new threats is much faster than for other industries. Consider a SIEM tool with strong analytics (UEBA) pedigree and good data ingestion and scaling capabilities.
I would take a long hard look at IBM QRadar. The user behavior analytics will give you insight into insider activity. You will want to run CIS internals on your endpoints and get detailed logs using their Wincollect server functionality. Using that alongside of something like Varonis and a decent DLP solution will give you complete insight into what your users are doing, when they did it, and what information was involved. Installing it is easy configuring it is formidable but the results will give you attribution and specificity. In addition the capabilities of QRadar allow the development of specific use cases that will detect anomalous behavior and provide excellent IOAS and IOCs.
Hi SOC analysts and other infosec professionals,
Which standard/custom method do you use to decide about the alert severity in your SOC?
Is it possible to avoid being too subjective? How do you fight the "alert fatigue"?
I'm the owner of a tech services company.
I'm looking for help with a template for a SIEM PoC (high-level, generic document). Can anyone help?