server farm isle

Cyberecurity 101: What is SIEM?

SIEM. Security Information and Event Management. It’s an essential part of any cybersecurity strategy, and yet oftentimes it is not that well known, and even those researching the topic are uninformed. As an example, I’ve heard it pronounced as ‘Siam’, ‘seam’, ‘sem’, and ‘sime’. We internally and most folks call it ‘sim’. If we can’t even agree on how to pronounce it how can we agree to define it? Well, thankfully that’s been taken care of. The term actually goes back to 2005, when Amrit Williams and Mark Nicollet from Gartner initialized the study of SIEM and coined the term.

BitLyft AIR® SIEM Overview

Prior to Mark and Amrit’s work, it was actually two distinct pieces of software, Security Information Management (SIM) and Security Event Management (SEM). SIM plus SEM equals SIEM. SIM offered storage, analysis and reporting of and from network log data, and SEM offered real-time monitoring, correlation, and notifications of that same log data. Combining the two allowed for dashboards that gave users the ability to have real-time alerts of what was happening across their network, including user activity, software and hardware.

7 Pitfalls of Using SIEM Tools

What Are the Benefits of SIEM?

Where SIEM really becomes powerful is parts of an overall security strategy. It gives the user, in particular, a well run Security Operations Center (SOC…more on these in a later post) access to volumes of data that can be used in a variety of ways. First and foremost this log data can be aggregated and organized. When logs are organized properly most SIEMs, out of the box, will have built alerts that let a user or a SOC know when something anomalous happens. This could be someone logging in from an odd location on up to a malicious threat. This also allows that data to be organized into dashboards that make it easy to see what just happened and analyze the alert.

BitLyft AIR® Security Operations Center Overview


Over time a SOC or user can correlate rules to that data to begin limited alerts, allowing the SIEM to do regular tasks that might be complex in quick operations so that alerts are reduced and only real problems come to the forefront. A proficient user can then being adding scripts, runbooks and the like to make the SIEM work for them and be tweaked and tuned for their environment. This will allow for other security tools, like SOAR, end-point protection and the like to be communicated with as part of an overall security strategy.

Many providers, like BitLyft, offer Security as a Service, or SECaaS, that uses SIEM as a foundation for a total package that lets our SOC and proprietary SOAR software act to make security efficient, proactive, and most importantly prepared to address threats that haven’t been seen yet. SIEM can even get involved with user authentication and complex operations like User Behavior Analytics (UBA or UEBA). This is key for organizations that have a wide-variety of users and multiple attack surfaces.

Another benefit of SIEM is the ability to have compliance reporting. Many organizations, such as those in defense contracting, higher education, financial services or national infrastructure, must meet standards based upon cybersecurity, and regularly face audits on those standards. SIEM allows them to schedule and run regular reports that can do in seconds what is needed to show compliance and give security teams significant cost savings back in the form of time. Examples of this may be CMMC, NIST, Title IV, NERC-CIP and a host of others. Many top SIEMS, like LogRhythm and Securonix, have these reports set up as standard parts of what they offer.

What SIEM Tools Should I trust?

While we are mentioning specific SIEMs, it is important to note that most years Gartner will release a report on the top SIEMs and make public a ‘magic quadrant’. Common players in that rather are IBM QRadar, Dell, Splunk and Rapid7. We at BitLyft are partners with two of the leaders, Securonix and Graylog. We have chosen them and been chosen by them for their leadership and technical advantages. Most importantly they are set up well for clients to glean what they need from the SIEM.

LogRhythm has been around for some time, and is one of the leaders in several areas. First and foremost they offer an unlimited pricing model in tiers, so organizations can have spending predictability that will make their boards happy. Also, LogRhythm is one of the leaders in reporting, is always evolving to meet the needs of their users, and operates a Security Operations Maturity Model, or SOMM, that takes a more wholistic approach and puts service on a pedestal.

Securonix is newer to the list, and actually built their reputation as a UEBA provider. The software is almost futuristic in its ability to operate and can do things that are innovative and forward-thinking that most SIEMs aren’t doing today. Essentially they built an epic software platform with everything they had seen in the market. In addition Securonix has an easy pricing model and is often a more economical model.

This should not be read to think SIEM is not without flaws or that work is not required. The biggest complaints in the market are that SIEMs produce too many alarms. This tends to fatigue users. Additionally, people say that they are too complex and become expensive shelfware.

While no SIEM is perfect it is important to pick a SIEM for the long-term that is easy for a team to use, highly functional, and will not break the bank. In addition, there are a lot of service providers that can make SIEM better than it will be stand-alone. In addition, having a total platform means that SIEM is a foundation, and other tools will be needed.

7 Pitfalls of Using SIEM Tools

Jason Miller

Jason Miller, Founder and CEO of BitLyft Cybersecurity, has dedicated his 20-year IT career, including co-founding SaaS pioneer Reviora, to removing cybersecurity barriers for mid-sized enterprises. Establishing BitLyft in 2016, Jason set out to unburden security teams with innovative, approachable, and affordable solutions, a vision which has made BitLyft a respected managed detection and response provider. Outside his cybersecurity pursuits, Jason is an avid tree farmer and outdoor enthusiast, planting nearly 300 trees on his ten-acre plot and finding joy in hiking, hunting, and driving his white Tesla Model 3. His diverse passions mirror the balanced blend of expertise, dedication, and joy he brings to BitLyft.

More Reading

man working on a computer
Top SIEM Products for Cybersecurity
When facing a cybersecurity incident, there is nothing more important than managing the event before things get too out of hand and end up costing your organization time, money, or damage to your...
two people handshaking
Cybersecurity Partner Or A Ticket Number?
Is your business being treated like a cybersecurity partner… or a ticket number? When considering how your managed SIEM service treats you as a customer, try this… imagine that you’re taking a...
woman looking at a laptop
Managed Cybersecurity Services
Companies desperately need help with managing their cybersecurity program. Not only are threats continually evolving, but the quantity of resources that firms must throw at the problem is tremendous...