Putting Security Event Data Management to Work
Mature organizations that utilize security information and event management (SIEM) tools want their technology to be more than just a fulfillment device. They want it to provide actionable data. But in making that transformation, they're running into the same data warehousing and data management problems that business intelligence professionals face. "The intersection of SIEM, data warehousing, and business intelligence resonates throughout the IT organization and is driven by three powerful forces: vast amounts of data being generated by IT systems; sophisticated and difficult to discover new threats; and the added complexity from mobile device proliferation, IT consumerization and cloud computing requirements. This combination creates a perfect storm for even the most advanced IT organization," wrote experts from Forrester Consulting, which recently released a study commissioned by data warehouse software provider Sensage that examined the practices of 60 SIEM-wielding enterprises. Of the organizations that responded, 95 percent pointed to one or more areas where they'd like to see more advanced analytics capabilities from their SIEM tool, including greater flexibility to pursue non-standard analysis and a more sophisticated correlation across siloed processes.
Microsoft is trying to better position itself and its channel partn...