{"id":30971,"date":"2021-03-10T12:36:50","date_gmt":"2021-03-10T19:36:50","guid":{"rendered":"https://www.webroot.com/blog/?p=30971"},"modified":"2021-03-10T12:36:52","modified_gmt":"2021-03-10T19:36:52","slug":"does-a-siem-make-sense-for-my-msp","status":"publish","type":"post","link":"https://www.webroot.com/blog/2021\/03\/10\/does-a-siem-make-sense-for-my-msp\/","title":{"rendered":"Does a SIEM make sense for my MSP?"},"content":{"rendered":"\n<p>Every device on an MSP\u2019s managed network provides insight into what&#8217;s happening on that network. This includes network routers, switches, printers, wireless devices to servers, endpoints, IoT devices and everything else connected to the network. Each creates a log in its own format, or syntax, that a technician can review for troubleshooting, configuration confirmation, the creation of specific alerts based on a device\u2019s activity or a host of other reasons. These records of each devices\u2019 activities are known as syslogs.<\/p>\n\n\n\n<p>Syslogs present information in a variety of ways, including custom formatting, industry-standard formatting, even raw data lacking a consistent format. The good news is that any activity requiring a security review is buried somewhere in these syslogs. The bad news is that data can <em>buried <\/em>in these syslogs.<\/p>\n\n\n\n<p>Whole mountain ranges of information are regularly processed by these systems. Millions upon millions of data points may be present, making the set overwhelmingly confusing. At best, sorting meaningful information from noise is a daunting task, even for well-staffed IT departments.<\/p>\n\n\n\n<p>Fortunately for security professionals\u2014and more specifically for MSPs and MSSPs focused on providing insight into their managed networks\u2014there is a mature product category that can be incorporated into their technology stack to help. Security information event management (SIEM) solutions have existed for years, but they\u2019ve recently been gaining traction among MSPs and MSSPs. For good reason: knowledge of a network\u2019s activity is essential to protecting it.<\/p>\n\n\n\n<h2>Is setting up a SIEM worth the cost and effort for an MSP?<\/h2>\n\n\n\n<p>The short answer is: YES. If you want to synthesize information from various sources to determine if a security event has or is taking place on a customer network, then yes, a SIEM is the natural evolution of the MSP security stack.<\/p>\n\n\n\n<p>The longer answer is, well, longer. Let&#8217;s break out a couple of options for those interested in establishing a more sophisticated security information and event management solution.<\/p>\n\n\n\n<p>SIM, SEM or SIEM? That\u2019s the question to begin with. While security information management (SIM) and security event management (SEM) solutions have been in place for some time, they&#8217;re now commonly combined into the offering referred to as a SIEM.<\/p>\n\n\n\n<p>So, where does an MSP get started? There are three common choices for getting a SIEM stood up and configured:<\/p>\n\n\n\n<ul><li><strong>On-premise<\/strong> \u2013 Stand up a server, add some software (a bunch, actually), point all the syslogs to the device and get started. Easy, right? In reality, on-premise solutions have a higher cost and can be daunting to get started. Software costs range based upon the solution provider\u2019s model. But if control and compliance are important, on-premise solutions may be a great option.<\/li><li><strong>Cloud-based<\/strong> \u2013 Any one of a number of existing solutions that cater to MSPs are simpler to get started. The challenge with cloud-based solutions entails pulling data from many sources and pushing it through firewalls and networks to a public cloud solution.<\/li><li><strong>Hybrid<\/strong> \u2013 As its name implies, some options blend cloud-based solutions with a local collection server to gather information and push a single source, securely, to the cloud for analysis and processing.<\/li><\/ul>\n\n\n\n<h2>Feeding your SIEM a healthy diet of data<\/h2>\n\n\n\n<p>Before deciding on a SIEM component, a log collection or data collection solution must be set up to feed it. Syslog collection refers to a number of different activities, but in a SIEM or security-specific sense it usually comes down to what makes the most sense for the application: purpose-built or generic.<\/p>\n\n\n\n<ul><li><strong>A syslog aggregator or log collector<\/strong> \u2013 These are devices that take in all syslog information from all devices. They range from sophisticated solutions with alerting and performance reviews to feeds that simply &#8220;normalize&#8221; the data, distilling the most relevant input and then reworking the details into a consistent standard and reporting on the highlights.<\/li><li><strong>Syslog bridges<\/strong> \u2013 These are more generic solutions that act mostly as log collectors. Simply point devices to this collector and it maps the data.<\/li><li><strong>Syslog collector<\/strong> \u2013 These are generic log collectors much like a bridges, but they usually provide a little more intelligence, cost more, and often serve multiple purposes like performance, device status and security event reporting.<\/li><\/ul>\n\n\n\n<p>Log gathering is the most misunderstood aspect of a SIEM and is often overlooked. The key is finding the most appropriate strategy for your needs.<\/p>\n\n\n\n<p>For most MSPs, a basic bridge with a specific security purpose for feeding a SIEM may be the most efficient and cost-effective option. For additional needs like performance or status determinations, a more sophisticated syslog may be good. But most performance and status information is already provided by RMM solutions, so why reinvent the wheel?<\/p>\n\n\n\n<h2>What to expect from your SIEM<\/h2>\n\n\n\n<p>After deciding on a syslog collector and SIEM setup, it\u2019s time to put the SIEM to work parsing data and making sense of the output. This is the intel that allow technicians to make sound decisions regarding security events.<\/p>\n\n\n\n<p>Which SIEM to incorporate into a given MSPs operations depends on the level of services offered. MSPs building out a SOC or offering managed detection and response (MDR) services may require more sophisticated output from their SIEM. MSPs simply looking to distill information for their respective technical teams to analyze and make security decisions can usually rely on tailored, cloud-based solutions.<\/p>\n\n\n\n<p>Regardless of the provider, a SIEMs should at least do the following:<\/p>\n\n\n\n<ul><li><strong>Perform log gathering<\/strong> \u2013 If log gathering is not directly accounted for by a SIEM, another solution will be necessary for feeding data to it.<\/li><li><strong>Correlate security events<\/strong> \u2013 To spot security threats that may be spread across a network, not only native to a single device\u2019s syslog, a SIEM must be able to track data across multiple devices.<\/li><li><strong>Connect to threat intelligence feeds<\/strong> \u2013 To keep up with a rapidly shifting threat landscape (and therefore useful to preventing attacks) it must be informed by strong threat intelligence feeds, preferably those using machine learning to recognize even zero-day threats.<\/li><li><strong>Issue security alerts<\/strong> \u2013 A key SIEM benefit is the ability to provide timely alerts regarding security events based on large amounts of data to assist with decision making, making it possible to stop attacks before they develop<\/li><li><strong>Present reports<\/strong> \u2013 Many SIEMs can produce reports in a cadence that makes sense for an MSP or MSSP depending on their needs and the needs of their clients.<\/li><li><strong>Enhance compliance<\/strong> \u2013 Because SIEMs aggregate information on a network, it can produce compliance reports for clients based on industry-specific needs.<\/li><\/ul>\n\n\n\n<p>A good SIEM solution can minimize technician workload and minimize manual data interpretation. It also benefits clients by beefing up your own security capabilities. A SIEM is a natural step for any growing MSP\u2019s looking to provide the best security solution for customers with workable margins.<\/p>\n\n\n\n<p>With a little focus, it shouldn&#8217;t take months or an act of congress to setup and use a SIEM. The above guidance should enable any MSP, regardless of size, to devise a viable plan for putting one in place.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every device on an MSP\u2019s managed network provides insight into what&#8217;s happening on that network. This includes network routers, switches, printers, wireless devices to servers, endpoints, IoT devices and everything else connected to the network. Each creates a log in its own format, or syntax, that a technician can review for troubleshooting, configuration confirmation, the [&hellip;]<\/p>\n","protected":false},"author":189,"featured_media":30973,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[3769,3557,23663,3479,17771,3789],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/30971"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/189"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=30971"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/30971\/revisions"}],"predecessor-version":[{"id":30977,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/30971\/revisions\/30977"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/30973"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=30971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=30971"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=30971"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=30971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}