Last Day to Get a MacBook Air, Surface Pro 7, or $350 Off with OnDemand - Register Now!


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

SANS@MIC- A walk through logs hell

  • Monday, June 15, 2020 at 8:30 PM EDT (2020-06-16 00:30:00 UTC)
  • Xavier Mertens

You can now attend the webcast using your mobile device!



Once upon a time, an ogre called SIEM" was invented!

Today, if your organization does not have a SIEM, you look like the "Little Tom Thumb among your peers. During infosec meetups, many people like to brag about the power of the monster they deployed: We can ingest 5K events per second! or we index 3TB a day! That looks indeed nice but does not impress me so much. Are you sure that you can still find the needle from a haystack?

Being involved with such technologies and environments for a while, I had the opportunity to face many situations where the ogre SIEM was not able to return interesting data due to mis-configurations, topology changes, lack (or absence) of logs, wrong normalization and many more... Managing logs and events is not an easy job. This presentation will tell you some nightmare stories that you could also face in your organizations. And, of course, some ideas to prevent them.

Speaker Bio

Xavier Mertens

Xavier Mertens is a freelance cybersecurity consultant based in Belgium. His daily job focuses on the “blue team” side to protect his customer’s assets (incident handling, forensics, log management, SIEM, security visualization, OSINT), but he likes to work on the “red team” side from time to time. Xavier is also a SANS Internet Storm Center Senior Handler (, security blogger ( and co-organizer of the BruCON security conference (

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.