BuzzSec - SIEM Gotchas

I had a customer ask me today if there were any gotchas I'm seeing with SIEMs right now that a prospective buyer should be aware of. It's a great question and wanted to share the answer with you all.

The biggest gotchas are 4 things I'm seeing

1. Can you use it to do threat hunting in your environment? Can you explore each finding well in the SIEM?
2. Can you get other threat intelligence feeds, paid and community, and can you put your own rules in with Yara or something similar?
3. Does the database support the amount of data you will have in there? Take the amount of logs in a month times 13 months and make sure the performance isn't going to lag.
1. For logs you're going to want VPN, IDS, IPS, Firewall in and out, web filtering, switches, Active Directory, data store file systems like SANs, email, databases, and any other high importance VMs in your enterprise. Also, make sure you can result your vulnerability scanning both active and passive in there.
4. If you have cloud resources, you'll want to monitor those as well.

Some vendors that do it for you in the cloud won't support threat hunting. Some vendors only allow their threat intelligence feeds. Some vendors have horrible database performance when there is a lot of data present. Some vendors do not have ANY cloud visibility.