Description

SIEM supports continuous collection, standardization, correlation, analysis, and reporting of security and operational information. SIEM is a security intelligence platform that has a unique ability to receive logs from other security tools such as Endpoint Detection and Response (EDR), Endpoint Protection Platform (EPP) endpoint solutions, Next generation Firewalls, UTMS, IPS, WAF and in real time provide information for correlation and analysis.

For the SIEM tools to be effective, it needs policies and regulatory processes transforming logs into intelligence and mixed with other forms of information (vulnerabilities assessments, threat intelligence). The most important functions of the modern SIEM solutions are related to threat detection, mitigation and response, compliance and regulation reports, use of advanced analytics and UEBA forensic analysis and SOAR .
Several aspects are positive contributing for the growth of the SIEM market, some to be highlighted are: Improved SIEM usability, To lower the barriers to adoption, providers are attempting to make SIEMs easier to use and also increase its relevance as a cybersecurity tool. The integration with threat intelligence and forensic analysis, compliance regulations such as GDPR, the use of cloud computing as an essential deployment vector for SIEM and the use of machine learning, deep learning and artificial intelligence to improve the effectiveness of SIEM.

Cloud solutions are becoming an important market driver for SIEM, Cloud distribution is likely to be less expensive than SIEM physical appliances or software. For small and midsized businesses, cloud-delivered SIEM services, either managed SIEM or SIEM-as-a-Service, are appealing alternatives. Due to complexity, skill shortages and cost, companies are now opting for the managed service, turning for a third party to manage their SIEM solution. This business model combined with cloud solutions facilitate SMBs to also have the benefit of SIEM solutions.

With the emergence of new types of attacks that use multiple vectors to penetrate a company, the necessity to analyze malwares, produce relevant alerts and block them before they penetrate the company network environment has become crucial. R&D investments are important in terms of customer protection. This is a constant necessity as threats evolve and as innovation becomes a key point for companies to differentiate themselves and create value for customers.

SIEM vendors should equip their channel partners with a sound go-to-market strategy so their partners can transform their sales motion from selling product to solving a business problem. MSSPs have an important participation in the distribution channel, as they are able to provide Service level agreements (SLAs) related to latency, availability, redundancy, support, and performance of technology resources, and provide the skilled resources.

Author: Mauricio Chede