When is SIEM the right choice over SOAR?

Gartner defines security information and event management (SIEM) products as technology that aggregates event data produced by security devices, network infrastructure, systems and applications. According to the analyst firm, the primary data source is log data, but SIEM technology can also process other forms of data, such as network telemetry data.

In the Gartner Magic Quadrant report for security information and event management, analysts note that event data can be combined with contextual information about users, assets, threats and vulnerabilities for the purposes of scoring, prioritisation and expediting investigations. This makes SIEM a pillar of enterprise IT security.

Rasika Somasiri, a cyber security expert at PA Consulting, says SIEM tools are one of the cornerstones of an effective monitoring capability in security operations. He says the alerts provided by a SIEM tool may point to a breach that is happening or help to predict one. 

“If you are responsible for security in a medium or large organisation and think you need a SIEM, you probably do – in fact, you probably have one already. Alongside your SIEM, you probably have a range of additional tools that provide security alerts,” says Somasiri.

But the problem with alerts is that IT security professionals need to act on them. “You need to validate that they constitute a real incident,” he adds.

This is why security orchestration, automation and response (SOAR) is starting to gain interest. Gartner defines SOAR as a class of products that combine incident response, orchestration and automation, and threat intelligence (TI) management capabilities in a single platform.

For BCS volunteer and security expert Petra Wenham, the question of whether SIEM or SOAR is the best security toolset for an organisation is a moot point. “There is overlap between the tools and, according to which tools you are looking at, the overlap can be quite small, particularly where the SIEM product has adopted artificial intelligence into the design,” she says.

Wenham believes the choice of product is not determined solely by the size of an organisation, but rather by the size and complexity of an organisation’s IT infrastructure and the value of the data held and processed by the infrastructure.

For instance, the larger and more complex the IT infrastructure is, and the greater the value of data held and processed, the greater the need to employ automation to undertake event correlation together with the short- and long-term analysis of alerts (security and others) generated within the infrastructure.

“Where possible,” says Wenham, “automation should be used to initiate corrective actions within the infrastructure as such automation would allow the freeing up of valuable IT and security staff to concentrate on the difficult-to-solve problems and on maintaining the infrastructure and associated management and monitoring toolsets.”