What Are Today’s Top SIEM Data Sources?

SIEM Data Sources

A security solution is only as good as its data sources, at least that’s what many would say. Cybersecurity teams typically go by with the data at their fingertips when looking into attacks and their sources. Without reliable information, they wouldn’t know where to begin or what the next step is.

A security information and event management (SIEM) platform is no exception. To provide real-time analyses of security alerts, it needs as much useful data, mostly from logs, to analyze and process. We compiled a list of the top SIEM data sources in this post to let you know how SIEM platforms can protect you at the optimum level.

Cloud Platform Logs

Any organization that uses Amazon Web Services (AWS), Salesforce, Microsoft Azure, Dropbox, and Google Cloud Platform (GCP), among many cloud services can get logs from their respective vendors. The information from these logs can help them respond to incidents, conduct forensic investigations, and get alerted to unauthorized access. Among the cloud platform log data they can feed their SIEM platforms are administrative logins to console portals, remote user access to sensitive data, and unauthorized cloud infrastructure changes.

DNS Logs

Since many breaches start when an employee accesses a malicious site typically by clicking a link embedded in a phishing email, Domain Name System (DNS) logs can also prove useful data sources for SIEM platforms. These let security teams know what sites users visit, letting them identify threat sources as soon as a compromise is detected. Without DNS logging tools like https://reverse-ip.whoisxmlapi.com/overview that provide simplified lists, though, DNS server logs can be hard to digest. Solutions that provide passive DNS data can make it easier for analysts and researchers to identify the origin of an attack.

Web Server Logs

Apart from unwary employees who end up visiting malicious websites or downloading malware onto their computers, another primary cause of braces are exposed public-facing web applications. An example would be the purchasing pages on a website. These have access to highly sensitive customer data and should thus be protected at all costs. Web server logs can clue SIEM platforms into unauthorized logins, fraudulent transactions, or similar malicious actions, such as accessing administrative portals outside regular business hours.

Firewall Logs

Firewall logs are a great source of detailed network flows. Next-generation firewalls go at least a step further by providing information on application types, threats, malware, and command-and-control (C&C) activity. Users can send these logs to their SIEM platforms to know where system users are connecting from. This information is critical when analyzing threats. These logs can also give security teams visibility when they’re looking for signs of lateral movement that is typical of targeted attacks.

Endpoint Security Solution Logs

The security solution installed on every device also provides crucial information for network analysts. Such data can enrich existing SIEM platform alerts with inventory data like the affected device’s operating system (OS), user, resource utilization, and others. If the affected system, for example, is an Android device, the security team may not need to look at Apple devices for similar signs of infection. In other cases, the infection on one computer can tell security pros what to do so the threat won’t spread throughout the network.

Threat Intelligence

Feeding SIEM platforms with third-party threat intelligence is also a good idea, as this can provide context to individual alerts. The better informed your platform is, so to speak, the more efficient it will be at identifying which alerts security teams should prioritize and why.

—

The six top SIEM data sources mentioned in this post are just a few of the feeds your platform can ingest to make alert prioritization, threat identification and correlation, and incident response easier and faster. Given these sources, security teams will have all the data they need to not just respond to but also mitigate future attacks.