Apa Itu SIEM and Reference File Download Link
https://eu2.contabostorage.com/00f3241116844f24b628f46d81abb929:st1/folder6/6624/1656159001_amended_annexure_2_technical_requirements_for_rfp_05_2017_18_dated_25072017_-_Standar_Format.xlsx
2026-05-30 07:46:05 - Admin
<style> body { font-family: Arial, Helvetica, sans-serif; line-height: 1.6; margin: 0; padding: 0; background-color: #fafafa; color: #333; } header { background-color: #0066cc; color: #fff; padding: 20px 10%; } header h1 { margin: 0; } nav { margin-top: 10px; } nav a { color: #fff; margin-right: 15px; text-decoration: none; } main { max-width: 800px; margin: 30px auto; padding: 0 10%; } h2 { color: #0066cc; margin-top: 1.5em; } ul, ol { margin-left: 20px; } table { width: 100%; border-collapse: collapse; margin: 20px 0; } th, td { border: 1px solid #ddd; padding: 8px; } th { background-color: #f2f2f2; } a { color: #0066cc; } </style><header> <h1>Apa Itu SIEM?</h1> <nav> <a href="#definition">Definition</a> <a href="#components">Core Components</a> <a href="#benefits">Benefits</a> <a href="#use-cases">Use Cases</a> <a href="#challenges">Challenges</a> <a href="#selection">Choosing a SIEM</a> </nav></header><main> <section id="definition"> <h2>What Is SIEM?</h2> <p> SIEM stands for <strong>Security Information and Event Management</strong>. It is a technology suite that aggregates, normalises, and analyses securityrelated data from a wide range of sourcessuch as firewalls, endpoints, servers, applications, and cloud servicesin real time. By correlating events across these disparate feeds, a SIEM enables security teams to detect suspicious activity, investigate incidents, and meet compliance reporting requirements. </p> </section> <section id="components"> <h2>Core Components of a SIEM</h2> <ol> <li><strong>Log Collection (Ingestion)</strong> Agents or APIs gather raw log data from devices and forward them to the SIEM.</li> <li><strong>Normalization & Parsing</strong> The SIEM translates logs into a common schema, making it easier to compare events from different vendors.</li> <li><strong>Storage</strong> Efficient, often indexed, storage retains logs for the period required by policy or regulation.</li> <li><strong>Correlation Engine</strong> Rules, statistical models, or machinelearning algorithms link related events to expose patterns that might indicate an attack.</li> <li><strong>Alerting & Notification</strong> When a rule is triggered, the system generates alerts that can be routed via email, SMS, Slack, or ticketing tools.</li> <li><strong>Dashboards & Reporting</strong> Visual interfaces display security posture, trends, and compliance status.</li> <li><strong>Incident Response Integration</strong> Some SIEMs include playbooks or connect to SOAR (Security Orchestration, Automation and Response) platforms for automated remediation.</li> </ol> </section> <section id="benefits"> <h2>Key Benefits</h2> <ul> <li><strong>Unified Visibility</strong>: A single pane of glass for logs across the entire environment, onpremises and in the cloud.</li> <li><strong>Rapid Detection</strong>: Realtime correlation reduces the time between a breach and its discovery.</li> <li><strong>Streamlined Forensics</strong>: Centralised logs simplify investigation and evidence collection.</li> <li><strong>Compliance Automation</strong>: Builtin reports help satisfy standards such as PCIDSS, HIPAA, GDPR, and ISO27001.</li> <li><strong>Scalability</strong>: Modern SIEMs can ingest millions of events per second, supporting large enterprises and MSPs.</li> </ul> </section> <section id="use-cases"> <h2>Typical Use Cases</h2> <table> <thead> <tr> <th>Use Case</th> <th>What the SIEM Does</th> </tr> </thead> <tbody> <tr> <td>Unauthorized Access Detection</td> <td>Correlates failed logins, VPN connections, and privilegedaccount use to flag possible credential theft.</td> </tr> <tr> <td>Malware Outbreak Identification</td> <td>Matches known Indicators of Compromise (IOCs) across endpoints and network devices, generating early warnings.</td> </tr> <tr> <td>Data Exfiltration Monitoring</td> <td>Detects unusual data transfers, large uploads to external sites, or atypical protocol usage.</td> </tr> <tr> <td>Compliance Auditing</td> <td>Runs scheduled queries to produce PCI, GDPR, or HIPAA audit reports automatically.</td> </tr> <tr> <td>UserBehavior Analytics (UBA)</td> <td>Applies statistical baselines to user activity, highlighting deviations that may indicate insider threats.</td> </tr> </tbody> </table> </section> <section id="challenges"> <h2>Common Challenges</h2> <p> While powerful, SIEM deployments can be complex. Typical hurdles include: </p> <ul> <li><strong>Alert Fatigue</strong> Overly broad rules generate excessive false positives, overwhelming analysts.</li> <li><strong>Resource Intensive</strong> Storage and processing requirements can be costly, especially at scale.</li> <li><strong>Complex Tuning</strong> Crafting effective correlation rules demands deep knowledge of the environment.</li> <li><strong>Integration Overhead</strong> Connecting legacy systems or cloud services may require custom parsers.</li> </ul> <p> Successful implementations invest in proper planning, phased rollouts, and continuous rule optimisation. </p> </section> <section id="selection"> <h2>Choosing the Right SIEM</h2> <p>When evaluating solutions, consider the following criteria:</p> <ol> <li><strong>Deployment Model</strong> Onpremises, cloudnative, or hybrid. Cloud SIEMs reduce infrastructure overhead but may raise dataresidency concerns.</li> <li><strong>Scalability & Performance</strong> Look for documented ingest rates (events per second) and storage elasticity.</li> <li><strong>Ease of Use</strong> Intuitive dashboards, builtin parsers, and preconfigured rule packs speed up timetovalue.</li> <li><strong>Integration Ecosystem</strong> Native connectors for firewalls, EDR, IAM, and ticketing tools.</li> <li><strong>Analytics Capabilities</strong> Rulebased detection, machinelearning models, and UEBA features.</li> <li><strong>Cost Structure</strong> Licensing can be pernode, perGB ingested, or subscriptionbased. Factor in hidden costs such as training and maintenance.</li> </ol> <p>Popular vendors include Splunk, IBM QRadar, ArcSight, LogRhythm, and newer cloudfirst platforms like Microsoft Sentinel, Sumo Logic, and Devo.</p> </section> <section> <h2>Conclusion</h2> <p> SIEM is the cornerstone of modern cyberdefence. By aggregating logs, normalising data, and applying intelligent correlation, it gives organisations the visibility and speed needed to detect, investigate, and respond to threats while satisfying regulatory obligations. Though implementation can be demanding, a welltuned SIEM dramatically improves security posture and reduces the risk of costly breaches. </p> <p>For teams just beginning their journey, start smallcollect critical logs, enable outofthebox analytics, and refine alerts over time. Expand coverage as you gain confidence, and always align your SIEM strategy with broader riskmanagement goals.</p> </section></main>