SANS@MIC- A walk through logs hell

  • Webcast Aired Monday, 15 Jun 2020 8:30PM EDT (16 Jun 2020 00:30 UTC)
  • Speaker: Xavier Mertens

Once upon a time, an ogre called 'sIEM" was invented!

Today, if your organization does not have a SIEM, you look like the "Little Tom Thumb ' among your peers. During infosec meetups, many people like to brag about the power of the monster they deployed: We can ingest 5K events per second! or we index 3TB a day! That looks indeed nice but does not impress me so much. Are you sure that you can still find the needle from a haystack?

Being involved with such technologies and environments for a while, I had the opportunity to face many situations where the ogre SIEM was not able to return interesting data due to mis-configurations, topology changes, lack (or absence) of logs, wrong normalization and many more... Managing logs and events is not an easy job. This presentation will tell you some nightmare stories that you could also face in your organizations. And, of course, some ideas to prevent them.