SecurityTrails Blog

Organizational policies act as the foundation for many programs, rules and guidelines by providing a framework to ensure clarity and consistency around an organization's operations.

The importance of information security can't be overstated. If compromised, customer and employee data, intellectual property, trade secrets and other highly sensitive and valuable information can mean the downfall of an organization, which makes keeping it secure one of the most critical operations to maintain. Therefore, a policy accounting for information security becomes an expected progression. With so many different types of data, systems that handle and store it, users that access it and risks that threaten its safety, it becomes increasingly important to have a documented information security policy. Furthermore, compliance requirements regulate ways in which organizations need to keep this information private and secure, further promoting the need for a document that will ensure those requirements are met. Regardless of size or industry, every organization needs a documented information security policy to help protect their data and valuable assets. But where to begin?

What is an information security policy?

An information security policy (ISP) is a high-level policy that enforces a set of rules, guidelines and procedures that are adopted by an organization to ensure all information technology assets and resources are used and managed in a way that protects their confidentiality, integrity and availability. Typically, an ISP would apply to all organization's users and IT data as well as infrastructure, networks, systems, third and fourth parties. Information security policies help organizations ensure that all users understand and apply the rules and guidelines, practice acceptable use of an organization's IT resources, and know how to act. Ultimately, the ISP's goal is to provide valuable direction to users with regard to security. The way an effective policy is shaped and customized is based on how an organization and its members operate and approach information.

ISP sets the tone for the implementation of security controls that will address an organization's relevant cybersecurity risks and procedures to mitigate them as well as the responsibilities needed to manage security properly. Furthermore, it's implemented in a way that supports their business objectives while adhering to industry standards and regulatory requirements. Organizations across industries design and implement security policies for many reasons. These include establishing a foundational approach to information security; documenting measures, procedures and expected behaviours that support and dictate the direction of overall security management; protecting customer and user data; complying with industry and regulatory requirements; and ultimately protecting their reputation.

The CIA triad

As mentioned, the main goal of an IT security policy is to maintain the confidentiality, integrity and availability of an organization's systems and information. Those three principles—confidentiality, integrity and availability—make up what is known as the CIA triad, a somewhat outdated, but still well-known model that remains at the foundation of many organizations' security infrastructure and security programs.

Confidentiality refers to an organization's efforts to keep sensitive data private. Personally identifiable information (PII), credit card data, intellectual property, trade sectors and other sensitive information need to remain private and accessible only to authorized users. This is generally conducted by controlling access to data, often seen in the form of two-factor authentication when logging into accounts or accessing systems, apps, and the like. Integrity in this context describes data that can be trusted. This means that data needs to be kept accurate and reliable during its entire lifecycle, so that it can't be tampered with or altered by unauthorized users. In...

Before an organization can develop and maintain a successful and relevant threat detection and defense strategy, it must first gain a solid understanding of common adversary techniques. The organization needs to know the various activities that can pose a threat, and how to detect and mitigate them.

With the current threat landscape featuring innumerable volumes of attack tactics and techniques, it proves challenging, if not nearly impossible, for every organization to monitor, document and communicate each of them. Cybersecurity frameworks provide a comprehensive plan of standards, guidelines and common language that can predict many of the challenges faced by organizations in protecting critical data and infrastructure in their efforts to better manage cybersecurity risks. Organizations commonly rely on these frameworks to alleviate guesswork, and provide a baseline structure that's further modified to meet the specific organization's needs and goals. After delving into the Nist Cybersecurity Framework, we now turn to another cybersecurity framework often used as a foundation for organizations developing customized threat models.

Mitre has developed the attack framework, which systematically defines and organizes common behaviour observed to be carried out by malicious attackers in the wild. It provides a common language that can be used by security teams to communicate these activities. The attack framework is globally recognized as an authority on understanding the behaviour models and techniques that adversaries use against organizations. It allows industry professionals a way to discuss, collaborate on and share intelligence regarding adversary methods and provides practical applications of detection, mitigation and common attributes.

What is the Mitre attack framework?

Mitre attack, an abbreviation of Mitre'S Adversarial Tactics, Techniques and Common Knowledge is a comprehensive knowledge base and framework for understanding and categorizing adversary behaviour based on real-work observations of various phases of their attack lifecycle. Created in 2013 by the Mitre Corporation, a not-for-profit organization that works across government agencies and various industry and academic institutions, the framework is a globally available collection documenting malicious behaviors carried out by advanced persistent threat (APT) groups. While information found in attack does represent APT behaviors, those malicious behaviors occur every day in organizations of all sizes. Consequently, various public and private sector organizations, no matter the size, have adopted the framework.

Importance of the Mitre attack framework

attack is regularly updated by Mitre experts, industry researchers and contributors, thus providing a relevant resource for organizations to create their own threat models and test in-place cybersecurity controls against threats in the current landscape. The tactics, techniques and procedures (TTPs) documented in the framework provide a standardized way for threat hunters, red teams, security operations centers (SOCs), and defenders to understand the cybersecurity risks of known adversary actions and inform a more vigorous defense strategy. To better grasp the importance of knowledge Mitre attack engages, let's turn to a concept developed by David Bianco called "Pyramid of Pain". Bianco argues that not all indicators of compromise (IoCs) are created equal. Just as in attack, Pyramid of Pain takes the adversary's point of view, defining the pyramid with levels of pain the adversary will feel when they are denied a specific indicator.

TTPs represent the apex of the pyramid, the highest pain level if denied to adversaries. When organizations detect and respond to threats at this level, it means they are operating based on adversary behaviors, rather than just their tools or parts of their attack sources. The thing is, tools can be replaced with other existing or newly created tools, but responding directly to adve...

Simply put, today's internet runs on DNS.

The concept is laced with hierarchical overtones, attributable to the structured nature of the protocol itself, and its pivotal role when it comes to the proper functioning of the network of networks. After all, a quick survey of today's visible internet rigorously points to a sizable dataset of nearly 364 million domain registrations across the most popular top-level domains. That's a testament to the rapidly growing need for coherent DNS and IP intelligence solutions that can quickly and effectively sort through the resulting complexity. In short, DNS records can reveal a plethora of important information, including perimeter protection mechanisms and technologies in use, inconsistencies in canonical entities pointing to specific security implications, and similar flaws leading to potential DNS takeover scenarios, so the value is definitely there.

At the heart of this blog post lies yet another attempt at recognizing the importance of information gathering and asset discovery regarding the efforts of security researchers and bug bounty hunters alike, as they strive for a suitable interplay of passive DNS enumeration capabilities and techniques. Our goal is to showcase the most commonly used subdomains and MX record types as they complement and enrich the asset discovery ecosystem. If you're in the business of network reconnaissance or asset discovery, mastering the above techniques can go a long way in ensuring flexibility when examining potential areas of exposure and validating legitimate targets of opportunity prior to any engagement.

Let's take a quick look.

Most popular subdomains on the internet

In the recent past, we've articulated that finding associated domains linked to a specific target is central to the idea of extending the attack surface. This long-standing argument reflects the possibility of both horizontal and vertical domain correlation, where the intent is to search for any available subdomains and siblings corresponding to the apex, success in this area is always measured in terms of forgotten or mishandled domain records as an additional target of opportunity for miscreants to capitalize on. As a refresher, domain name features consist of human-readable character strings with a one to one correspondence pointing to a specific web resource. In turn, the canonical internet protocol (DNS) leverages a subordinate arrangement starting with TLDs, or top-level domains, composed of prominent extensions such as .com or .net, followed by second- and third-level domains which consumers can acquire and control at will.

This form of domain administration allows for further specialization whereby domains can be scaled to generate the desired aggregates. For instance, third-level domains, or subdomains as they are normally referred to, can identify an FTP server simply by prepending ftp to domain.com; this denotes the collective designation of a resource via a unique identifier such as ftp.domain.com, otherwise known as a fully qualified domain name, or FQDN. Playing a role often attributed to hostnames within organizational boundaries, subdomains typically exhibit the greatest flexibility when it comes to naming conventions. Thus, large-scale DNS intelligence dictates that keeping an eye on the fluidity within domain names offers a critical view of the threat landscape. This is also the case where subdomain knowledge is leveraged at high-level stages of the recon process, targeting institutional privacy via recursive DNS data and any resulting bidirectional activity in the process.

So, what are the top most popular subdomains, and how can we identify them?

From a corpus of over 17 billion records of crawled web data for the .com TLD, and associated URLs, hosted at Common Crawl, we set out to investigate the feasibility of pulling a subset of these records using a common programming language like Python, some commodity hardware, and supporting tools like the CDX Toolkit. Wor...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Without DNS and domain names, our experience of browsing the web would be quite different. As users, we would have to actually memorize the IP addresses of websites we want to visit, which doesn’t seem like a pleasant user experience at all.

DNS is the system that associates domain names with IP addresses, so whenever we type in “securitytrails.com”, DNS uses a series of protocols to connect us with the authoritative DNS server of the domain name and serves us the content we intended to visit. DNS is one of the most popular internet services, and at the same time, is vulnerable to DNS-based attacks. Understanding DNS is an important step to prevent DNS attacks. DNS servers contain one critical component: the DNS zone file. This file contains a variety of DNS records, each of which contains specific instructions for other servers to follow in order to connect to different services on the domain, such as the web server to visit a website or a mail server. Most domain owners and users are familiar with "standard" DNS record types such as the A record, Cname, MX and TXT records, as they are responsible for the everyday actions of online users.

But beyond those more commonly used is an amazingly large list of DNS record types many users haven't heard of. Let's refresh our knowledge about the most common DNS record types, and go over a list of all other, lesser-known ones in use today.

What are DNS records?

As mentioned, DNS records are essentially the instructions found on authoritative DNS servers and stored in their zone file. All domains need to have the few necessary records that allow a user access to a website, but there are many different DNS records involved. These include mail records, website records and informational records, among others. If you're interested in learning more about the inner workings of DNS, check out our DNS root servers post. Each DNS record has different components: the domain name; time to live (TTL), i.e. the time in seconds in which the client can store the record in cache before the information must be requested again from the DNS server; class, which is set to IN (internet) for common DNS records that involve hostnames, servers or IP addresses; the record type; and the type data, which is the information according to which the domain can be resolved.

All of these components of the DNS record are structured in the DNS record syntax, which typically follows the format:

Thus, a DNS record for the website.com web server will then look like this:

Record types are of high interest, as they indicate the format of the data in the record and instruct on its intended use—for example, the MX record that contains the location of the mail server.

Most common DNS record types

Since the early days of DNS, the internet has morphed and advanced in such a way that DNS record types have constantly changed right along with it. Many have become obsolete, only to be replaced with newer types. Some of the most common DNS record types are:

A record

A records are among the simplest and most fundamental DNS record types. The "A" stands for "address" and when you want to visit a website, send an email or, really, do anything on the internet, the domain you enter needs to be connected with the associated IP address. A records indicate the IP address for the given domain.

An example of an A record would look like:

For example, if you enter "securitytrails.com" the A record will point you to the 151.101.2.132 IP address, essentially connecting your device with our website. Most websites have a single A record, but you can use multiple A records for the same domain to provide redundancy, or use a number of domain names that each have an A record pointing to the same IP address. Something important to know about A records is that they only contain IPv4 addresses.

AAAA record

What A records are to IPv4 addresses...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Securitytrails 125,000 users can now integrate with the leading SOAR platform.

We're excited to announce the immediate availability of our latest API integration into Palo Alto Networks Cortex XSOAR, enabling users to operationalize our security intelligence with over 750 different products. Palo Alto Networks Cortex XSOAR is one of the most comprehensive security orchestration solutions on the market today, enabling organizations to manage and collect data about security threats and drive responses with reduced human involvement. These automated playbooks are an incredible time-saver for overworked security teams. Securitytrails real-time analysis of hostnames, associated domains, IP blocks, SSL certificates, WHOIS, DNS, and historical DNS provides unrivaled context to security investigations. Securitytrails XSOAR enrichments can support a wide variety of playbooks including phishing, log-in analysis, vulnerability management, IOC enrichment, and endpoint diagnostics.

How does it work?

In order to configure Securitytrails on the Cortex XSOAR platform, you'll need to follow these steps:

Navigate to Marketplace. Search for Securitytrails. Click "Install". Navigate to Settings > Integrations > Servers & Services. Search for Securitytrails. Click Add instance to create and configure the new integration instance. Few parameter configurations are required:

API key: api.key.here. Trust any certificate (not secure): False. Use system proxy settings: False. Fetch indicators: False. Click Test to check if the URLs, token, and connection are working as expected. If you see a "Success" message, then you're ready to start playing with it. Jump into the playground, and start executing the Securitytrails commands. In the footer area, you'll find a CL-I where you can execute any supported Securitytrails commands, as shown here:

Supported commands

The following is a list of supported commands that can be executed within Cortex XSOAR CL-I, whether as part of an automation or in a playbook (once you execute a command, a DBot message will be displayed in the War Room showing the command details):

With this new Securitytrails API integration for XSOAR, we are helping thousands of users access security data from our API in more alternative ways, providing more clarity for security companies to access subdomain and domain data, DNS and WHOIS historical records, associated domains and IPs, company details, user-agent activity, and much more. Access the Securitytrails API integration for XSOAR today.

Securitytrails 125,000 users can now integrate with the leading SOAR platform.

We're excited to announce the immediate availability of our latest API integration into Palo Alto Networks Cortex XSOAR, enabling users to operationalize our security intelligence with over 750 different products. Palo Alto Networks Cortex XSOAR is one of the most comprehensive security orchestration solutions on the market today, enabling organizations to manage and collect data about security threats and drive responses with reduced human involvement. These automated playbooks are an incredible time-saver for overworked security teams. Securitytrails real-time analysis of hostnames, associated domains, IP blocks, SSL certificates, WHOIS, DN-S, and historical DN-S provides unrivaled context to security investigations. Securitytrails XSOAR enrichments can support a wide variety of playbooks including phishing, log-in analysis, vulnerability management, IOC enrichment, and endpoint diagnostics.

How does it work?

In order to configure Securitytrails on the Cortex XSOAR platform, you'll need to follow these steps:

Navigate to Marketplace. Search for Securitytrails. Click "Install". Navigate to Settings > Integrations > Servers & Services. Search for Securitytrails. Click Add instance to create and configure the new integration instance. Few parameter configurations are required:

API key: api.key.here. Trust any certificate (not secure): False. Use system proxy settings: False. Fetch indicators: False. Click Test to check if the URLs, token, and connection are working as expected. If you see a "Success" message, then you're ready to start playing with it. Jump into the playground, and start executing the Securitytrails commands. In the footer area, you'll find a CL-I where you can execute any supported Securitytrails commands, as shown here:

Supported commands

The following is a list of supported commands that can be executed within Cortex XSOAR CL-I, whether as part of an automation or in a playbook (once you execute a command, a DBot message will be displayed in the War Room showing the command details):

securitytrails-get-subdomains.. securitytrails-get-domain-details. securitytrails-get-tags. securitytrails-get-company-details. securitytrails-get-company-associated-ips. securitytrails-get-domain-whois. securitytrails-get-dns-history. securitytrails-get-whois-history. securitytrails-get-ip-neighbors. securitytrails-search-domain. securitytrails-statistics-domain. securitytrails-get-associated-domains. securitytrails-search-ip. securitytrails-statistics-ip. securitytrails-get-ip-whois. securitytrails-get-useragents. domain. With this new Securitytrails AP-I integration for XSOAR, we are helping thousands of users access security data from our API in more alternative ways, providing more clarity for security companies to access subdomain and domain data, DN-S and WHOIS historical records, associated domains and IPs, company details, user-agent activity, and much more. Access the Securitytrails AP-I integration for XSOAR today.

While digital forensics may have come from a fairly dubious tradecraft background, it has grown to be a major part of many cyber crime investigations. Developments in the field in terms of research, tools and techniques have brought digital forensics to a whole new level.

Whether providing valuable evidence that assists in the investigation and prosecutions of crime perpetrators or proving their innocence or as part of the post-breach investigation and incident response process in organizations of all sizes, digital forensics is a widely used craft by investigators in all sectors. The ever-growing advancements in information technology have potentially proven challenging to the branch of digital forensics, but its tools and techniques are continuously used to collect, process, preserve and analyze evidence from a range of digital devices, help uncover vulnerabilities and threats and ultimately help inform ways to mitigate them.

What is digital forensics?

Formally, digital forensics is defined as the branch of forensic science that is concerned with the identification, preservation, extraction and documentation of digital evidence using scientifically validated methods, evidence that will ultimately be used in a court of law. The term originated from "computer forensics" which includes the investigation of computers and digital storage media, but it has separated into a discipline focused on handling digital evidence found on all digital devices that store data. Digital evidence can be collected from many sources. These include computers, laptops, mobile phones, digital cameras, hard drives, IoT, CD-ROM, USB sticks, databases, servers, cloud, web pages, and more. Data sources like these are subject to digital forensics investigations, and must be handled with the utmost care to avoid any modification or contamination.

When it comes to different types of electronic evidence, these include media files (photos, videos, audio), text messages, call logs, social media accounts, emails, internet search history, user account data (usernames, passwords), RAM system files, digital files (PDFs, spreadsheets, text files), network device records, computer backups, and much more. While in the past more commonly known as a practice used in legal cases, today the term "digital forensics" is also used to describe a process of cyber crime investigation in the private sector, even without the involvement of law enforcement or the court. Once a security breach occurs, organizations leverage digital forensics professionals to identify the attack, determine how the attackers gained access to the network, trace the attackers' movement through the network, ascertain whether information has been stolen, and recover compromised data.

This can involve decryption, recovering deleted documents, files, cracking passwords, and the like.

What is digital forensics used for?

Digital forensics tools and techniques are used regularly by analysts and investigators in law enforcement, military, and government organizations as well as organizations in the private sector. Therefore the two main use cases for digital forensics are criminal cases or public investigations, and private or corporate investigations:

Public sector

Government agencies and law enforcement use digital forensics to obtain additional evidence when a crime has occured, whether it's cyber crime or another type of crime, to support allegations against a suspect. In cyber crime investigations, digital forensics investigators are employed by government agencies once an incident is detected, to find evidence for the prosecution of crimes. Not only is digital forensics useful for solving different types of cyber crime such as data breaches, ransomware and data theft, but it can also be used to solve physical crimes, such as burglary, assault, fraud and murder. The evidence uncovered can lead an investigation toward motives behind the crime and can even connect the suspect to the crime scene or suppo...

What began as a tool for helping organizations achieve and maintain compliance, security information and event management , SIEM rapidly evolved into an advanced threat detection practice. SIEM has empowered incident response and security operations centers (Soc) analysts as well as a myriad of other security teams to detect and respond to security incidents.

While there may be talk about SIEM joining the line of legacy technologies that are proclaimed "dead", SIEM has been a core system for many security teams, and in different capacities. Furthermore, SIEM (along with its evolution) has been intertwined with relevant threats in the ecosystem as well as the market in which it is used. Systems and infrastructures that security professionals must secure in 2021 are vastly different from the systems in use when SIEM first came to the scene. But even if many have decided that SIEM is a thing of the past, its underlying principles and technology remain visible in many new systems such as SOAR, XDR, MDR and other solutions that integrate SIEM capabilities. Vendors and reimaginations come and go, but SIEM prevails as a technology that should be recognized. There will always be a need for experienced individuals to work with SIEM and know how to apply it to the appropriate business touchpoints.

We've put together an overview of the history, definition, use cases as well as benefits and limitations of SIEM to provide a greater understanding of its continued usefulness in any security team's toolstack.

What is SIEM?

SIEM stands for security information and event management. It provides organizations with detection, analysis and response capabilities for dealing with security events. Initially evolving from log management, SIEM has now existed for over a decade and combines security event management (SEM) and security information management (SIM) to offer real-time monitoring and analysis of security events as well as logging of data. SIEM solutions are basically a single system, a single point that offers teams full visibility into network activity and allows for timely threat response. It collects data from a wide range of sources: user devices, servers, network equipment and security controls such as antivirus, firewalls, IPSs and IDSs. That data is then analysed to find and alert analysts toward unusual behavior in mere seconds, letting them respond to internal and external threats as quickly as possible.

SIEM also stores log data to provide a record of activities in a given IT environment, helping to maintain compliance with industry regulations. In the past, SIEM platforms were mostly used by organizations to achieve and maintain compliance with industry-specific and regulatory requirements. What brought about its adoption across many organizations was the Payment Card Industry Data Security Standard (PCI DSS) and similar regulations (HIPAA). As advanced persistent threats (APTs) became a concern for other, smaller organizations, the adoption of SIEM has expanded to include a wide array of infrastructures. Today's SIEM solutions have evolved to address the constantly shifting threat landscape, and is now one of the core technologies used in security operations centers (Soc).

Advancements in the SIEM field are bringing forward solutions that unify detection, analysis and response; implement and correlate threat intelligence feeds to provide added intelligence to Socs; and include or converge with user and entity behaviour analytics (UEBA) as well as security orchestration, automation and response (SOAR).

How does a SIEM solution work?

A SIEM solution works by collecting security event-related logs and data from various sources within a network. These include end-user devices, web, mail, proxy and other servers, network devices, security devices such as IDS and IPS, firewalls, antivirus solutions, cloud environments and assets, as well as all applications on devices. All of the data is collected and analyzed in a centralized loca...

ORLANDO, FL, September 14, 2021 - SecurityTrails, the Total Internet Inventory, announced it has invested in the enterprise-ready asset monitoring provider Surface.io in an effort to deliver continuous attack surface monitoring through their Attack Surface Reduction platform.

"SecurityTrails' comprehensive inventory combined with Surface.io's rapid identification of risky assets and services will provide our customers complete visibility into their real-time attack surface."

Chris Ueland, CEO & Co-Founder, SecurityTrails.

While launching their attack surface management offering, SecurityTrails conducted over 50 customer interviews to assess areas of improvement. Surface.io filled those gaps with its continuous asset monitoring capabilities, featuring best of breed modern code and expertise to make the concept of assets, applications and endpoints known.

Surface.io discovers all assets in a company's external infrastructure and uses best of breed analysis to provide targeted data gathering on assets that really matter. This provides security teams the ability to ask crucial questions and confirm hypotheses about their external infrastructure. With this acquisition, SecurityTrails aims to empower over 125,000 users worldwide to get intel on their internet assets faster and with greater accuracy to eliminate any potential security threats.

"As we take this incredible tool and scale it to the entire internet, we will greatly increase our ability to identify critical risks and establish a complete picture of your infrastructure. This is a huge step forward in our mission to ensure you are never blindsided by unknown risks," states Courtney Couch, Co-Founder & Chief Innovation Officer.

SecurityTrails team is excited to welcome the power and features of Surface.io to help them further their mission to become the Total Internet Inventory. Integration with Surface.io has already begun and features will be accessible to customers soon.

About SecurityTrails

SecurityTrails is a total inventory that curates comprehensive domain and IP address data for users and applications that demand clarity. By combining current and historic data of all Internet assets, SecurityTrails is the proven solution for 3rd-party risk assessment, attack surface reduction and threat hunting. From knowing an organization's attack surface, shadow infrastructure, and spotting new domains, SecurityTrails makes sure there's nothing left to be discovered. Learn more at www.securitytrails.com and follow us on Twitter @securitytrails.

What began as a tool for helping organizations achieve and maintain compliance, security information and event management , SIEM rapidly evolved into an advanced threat detection practice. SIEM has empowered incident response and security operations centers (SOC) analysts as well as a myriad of other security teams to detect and respond to security incidents.

While there may be talk about SIEM joining the line of legacy technologies that are proclaimed "dead", SIEM has been a core system for many security teams, and in different capacities. Furthermore, SIEM (along with its evolution) has been intertwined with relevant threats in the ecosystem as well as the market in which it is used. Systems and infrastructures that security professionals must secure in 2021 are vastly different from the systems in use when SIEM first came to the scene. But even if many have decided that SIEM is a thing of the past, its underlying principles and technology remain visible in many new systems such as SOAR, XDR, MDR and other solutions that integrate SIEM capabilities. Vendors and reimaginations come and go, but SIEM prevails as a technology that should be recognized. There will always be a need for experienced individuals to work with SIEM and know how to apply it to the appropriate business touchpoints.

We've put together an overview of the history, definition, use cases as well as benefits and limitations of SIEM to provide a greater understanding of its continued usefulness in any security team's toolstack.

What is SIEM?

SIEM stands for security information and event management. It provides organizations with detection, analysis and response capabilities for dealing with security events. Initially evolving from log management, SIEM has now existed for over a decade and combines security event management (SEM) and security information management (SIM) to offer real-time monitoring and analysis of security events as well as logging of data. SIEM solutions are basically a single system, a single point that offers teams full visibility into network activity and allows for timely threat response. It collects data from a wide range of sources: user devices, servers, network equipment and security controls such as antivirus, firewalls, IPSs and IDSs. That data is then analysed to find and alert analysts toward unusual behavior in mere seconds, letting them respond to internal and external threats as quickly as possible.

SIEM also stores log data to provide a record of activities in a given IT environment, helping to maintain compliance with industry regulations. In the past, SIEM platforms were mostly used by organizations to achieve and maintain compliance with industry-specific and regulatory requirements. What brought about its adoption across many organizations was the Payment Card Industry Data Security Standard (PCI DSS) and similar regulations (HIPAA). As advanced persistent threats (APTs) became a concern for other, smaller organizations, the adoption of SIEM has expanded to include a wide array of infrastructures. Today's SIEM solutions have evolved to address the constantly shifting threat landscape, and is now one of the core technologies used in security operations centers (SOC).

Advancements in the SIEM field are bringing forward solutions that unify detection, analysis and response; implement and correlate threat intelligence feeds to provide added intelligence to SOCs; and include or converge with user and entity behaviour analytics (UEBA) as well as security orchestration, automation and response (SOAR).

How does a SIEM solution work?

A SIEM solution works by collecting security event-related logs and data from various sources within a network. These include end-user devices, web, mail, proxy and other servers, network devices, security devices such as IDS and IPS, firewalls, antivirus solutions, cloud environments and assets, as well as all applications on devices. All of the data is collected and analyzed in a centralized loca...