Análise e desenvolvimento de métricas de eficiência para SIEM

Abstract

SIEMs are responsible for managing events and are able to identify potential threats in real time by correlating and analyzing thousands of events per second. Currently, the great challenge is to maintain an information security event management and correlation system (SIEM) that is efficient and effective, bringing much more visibility to the organization’s infrastructure and having a greater efficiency gain, mainly involving threat identification. Thus, the aim of this study is to develop a method to characterize the efficiency of SIEMs, independent of the model and infrastructure, through a set of metrics to be projected based on the experience obtained with the direct action with SIEMs in different environments. Based on professional experience and studies carried out in a corporate environment containing thousands of EPS (events per second) generated due to the large number of machines used, Cloud environment, ADs, DLPs, Proxies and antivirus. Metrics will be created taking into account data on EPS (events per second) and offenses created by the SIEM, which may be used regardless of the SIEM and business environment. Thus, companies with complex environments, with thousands of events generated by second, they can really monitor their efficiency easily and quickly, and the method could be adopted by suppliers of SIEM to demonstrate the real efficiency of your tool in various simulated environments, as well as increase the performance of SOCs by use the method to continuously improve your SIEM, verifying its efficiency in routine tests.