{"id":2493,"date":"2024-05-22T15:26:56","date_gmt":"2024-05-22T05:26:56","guid":{"rendered":"https:\/\/girl-germs.com\/?p=2493"},"modified":"2024-05-24T10:03:12","modified_gmt":"2024-05-24T00:03:12","slug":"when-it-siems-like-youre-getting-it-all-wrong","status":"publish","type":"post","link":"https:\/\/girl-germs.com\/?p=2493","title":{"rendered":"When it SIEMS like you&#8217;re doing it all wrong&#8230;"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To make life easier for folks, I figured that consolidating all the checklist items from my latest AusCERT 2024 talk would be a good idea &#8211; now you can have your own printable list!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For those who have no idea what I&#8217;m talking about, WATCH THIS SPACE &#8211; when the talk is uploaded, I&#8217;ll be sure to link it here!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, feel free to print out and mark off the items you&#8217;ve done&#8230;and use it to get things working well!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Architecting &amp; Configuring<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Know your \u2018Why\u2019<\/li>\n\n\n\n<li>Decide if on-prem or cloud-based<\/li>\n\n\n\n<li>Pick the location your SIEM is going to reside in<\/li>\n\n\n\n<li>Use a SIEM that is designed to BE a SIEM<\/li>\n\n\n\n<li>Pick a SIEM that you know will integrate with your other tools<\/li>\n\n\n\n<li>Understand storage considerations (Hot vs. Cold)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Ingestion<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Don\u2019t collect into your SIEM simply for the sake of collecting it<\/li>\n\n\n\n<li>Use filters where possible to remove noise from your ingestion<\/li>\n\n\n\n<li>Avoid sending operational\/performance data<\/li>\n\n\n\n<li>Don\u2019t duplicate the data \u2013 either within the SIEM or elsewhere<\/li>\n\n\n\n<li>Don\u2019t duplicate SIEM functionality \u2013 use as few tools as possible<\/li>\n\n\n\n<li>Don\u2019t have data caps, unless they are ridiculously high<\/li>\n\n\n\n<li>Don\u2019t have heavy limitations on collections \u2013 filter, yes; limit, no.<\/li>\n\n\n\n<li>Ingest data from your Dev\/Test\/Staging environments<\/li>\n\n\n\n<li>Ingest data from your legacy systems<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Automation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use where it make sense \u2013 you can\u2019t automate everything!<\/li>\n\n\n\n<li>Make sure you understand what you\u2019re automating BEFORE automating<\/li>\n\n\n\n<li>Understand the different types of automation available and their impact<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Health &amp; Monitoring<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regularly monitor the health of your SIEM system and all components related to it<\/li>\n\n\n\n<li>Monitor and alert for potential insider threats within the SIEM itself<\/li>\n\n\n\n<li>Monitor the cost of your SIEM \u2013 no one wants bill shock!<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">People &amp; Process<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Have enough people to do the work \u2013 and if you don\u2019t, make the best use of the folks you DO have<\/li>\n\n\n\n<li>Don\u2019t push your Operational Security work onto your Operations staff \u2013 you need a SOC<\/li>\n\n\n\n<li>Aim to fit your SIEM into your existing SOC process<\/li>\n\n\n\n<li>Create (and test) your incident response plans<\/li>\n\n\n\n<li>Measure the efficiency of your SOC\/SIEM<\/li>\n\n\n\n<li>Give access where it\u2019s needed \u2013 don\u2019t gatekeep<\/li>\n\n\n\n<li>Train your staff \u2013 upskill them in the solutions they\u2019ll be using<\/li>\n\n\n\n<li>Look after the wellbeing of your people \u2013 including yourself!<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>To make life easier for folks, I figured that consolidating all the checklist items from my latest AusCERT 2024 talk would be a good idea &#8211; now you can have your own printable list! For those who have no idea what I&#8217;m talking about, WATCH THIS SPACE &#8211; when the talk is uploaded, I&#8217;ll be sure to link it here!&#8230; <a href=\"https:\/\/girl-germs.com\/?p=2493\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[10,8,328,2],"tags":[],"class_list":["post-2493","post","type-post","status-publish","format-standard","hentry","category-conferences","category-documentation","category-techstuff","category-technology"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2Tmk1-Ed","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/2493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2493"}],"version-history":[{"count":6,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/2493\/revisions"}],"predecessor-version":[{"id":2555,"href":"https:\/\/girl-germs.com\/index.php?rest_route=\/wp\/v2\/posts\/2493\/revisions\/2555"}],"wp:attachment":[{"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/girl-germs.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}