Security Information and Event Management (SIEM)
Produkty
Bezpieczeństwo IT 
Infrastruktura IT i OT
Security Information and Event Management (SIEM)
The main task of SIEM systems (a combination of SIM* and SEM**) is to support security incident management with information management of the monitored environment. Not to mention facilitating compliance of the monitored environment with the required standards.
Within one coherent system we find:
- tools for traditional log collection and storage,
- tools or systems that focus on the collection and management of security-related data from multiple sources, such as firewalls, DNS servers, routers, anti-virus,
- finally, systems based on proactive monitoring and analysis, including data visualisation, event correlation and alerting,
SIEM works by collecting logs and events generated by hosts, security systems, and applications across an organisation’s infrastructure and collating them on one centralised platform.
SIEM has to:
- to know what is connected to the network,
- have the ability to collect events from anti-virus software or firewall logs to identify this data and categorise it, which then helps to track cyber threats.
*SIM – collects data from network devices in a central repository, enabling automated report generation
**SEM – collects event data in a central repository, enabling real-time analysis
Response to the challenge
Correlation of information from multiple sources within the ICT infrastructure to detect adverse events
What can you get when implementing a SIEM solution in an organisation?
With SIEM, the clarification of security incidents for the entire ICT system area takes place in one place
Management
Security information and event management with user and entity behaviour analysis (UEBA)
Unification
Unified data collection and analysis from a variety of information sources, including logs, performance metrics, as well as security alerts and configuration changes
User control
Insights into unusual user behaviour in relation to critical data. Furthermore, it is possible to build profiles of users, peer groups, endpoints, applications, files and networks
Visibility
Visibility of end-to-end activities, from endpoints to local servers and network activity to cloud applications
Products we offer as part of the SIEM solution
Fortinet - FortiSIEM
It combines visibility, correlation, automated response and remediation in a single, scalable solution. Reduces the complexity of network management and security operations
Zobacz więcej
Energy Logserver
The architecture of this solution allows for the secure collection of unlimited amounts of network data, in addition to providing efficient search mechanisms
Zobacz więcej