Network Security 2018

Stuck in the Box, a SIEM's Tale

• Justin Henderson
• Monday, September 24th, 8:15pm - 9:15pm

Organizations often spend excessive amounts of money on SIEM products only to end up with a log collection box when they thought they purchased a tactical detection system. Most organizations find themselves with a SIEM but unsure how to use its capabilities. Point solutions are quick to defend deficiencies by stating each environment is different so you, the customer, must tell them what you want the SIEM to do and then they'll help with professional services or by replacing your current SIEM with something "better and more advanced." This is complete hogwash. Organizations tend to have a lot of overlap such as the use of Windows systems or network protocols such as DNS. As such there are high fidelity detects that can be implemented in every organization.

Enough is enough. If you are looking for techniques and methods to get value out of your current SIEM or are interested in seeing how a new open source big data solution such as the Elastic Stack, formerly ELK, most likely can beat what you have today then this talk is for you. Fact is that it is time to think outside the box. Come find out how one organization spent fourteen months deploying a top magic quadrant SIEM solution to have it beaten by ELK in two weeks.