SIEMs:

Empty Promises
EMPTY PROMISES?
Your SIEM will help you:
1. Identify blind spots
2. Reduce noise and alert fatigue
3. Simplify detection and response
to complex attacks
YOUR EXPERIENCE AND THE DATA SAY DIFFERENTLY

76% 70% 75%

THREATS ON DATA AND VISIBILITY
THE RISE ALERT FATIGUE GAPS
Threat detection and response is more It is difficult for my organization to keep It is difficult to synthesize
difficult today than it was two years ago, up with the volume of security alerts different security data telemetry
current detection and response tools generated by our security analytics tools for security analytics
aren’t keeping up

75% 75%
TOOLS PEOPLE
FAILING SKILL GAP
My organization has deployed one or The cybersecurity skills shortage *Survey results obtained by
several security analytics technologies has impacted security analytics
which have not lived up to expectations and operations at my organization
Enterprise Strategy Group
 CHANGING FOCUS FROM DATA TO CORRELATIONS
The Three Phases of Cyber Security

Challenge:
RISE OF DATA Responding to critical
Increase the amount
of data achieving
+ + + attacks is like finding needles
in a haystack, labor intensive
comprehensive visibility and time inefficient
Logs Packets Files Users

RISE OF AI Challenge:
Use machine learning NTA EDR UEBA Siloed AI-driven tools increase
with big data analysis noise and alert fatigue, driving
to help find and up capital and operational costs
Network Endpoint Detection User & Entity
automate detections
Traffic Analysis & Response Behavior Analysis

RISE OF
CORRELATIONS Single platform to detect,
correlate and respond across
Correlate detections and the entire kill chain
automate response across
entire attack surface
 SIEMs have been the foundation of security through these detections and get a
A LONG HISTORY OF operations for decades, and that should be sense of what is critical vs. noise. The
UNFULFILLED VISION acknowledged. However, SIEMs have made main purpose of SIEMs is to collect and
a lot of great promises, and to this day, have aggregate data such as logs from different
not fulfilled many of them, in particular, tools and applications for activity visibility
the vision of automatic correlation of and incident investigation.
detections holistically.
There are still a lot of manual tasks needed,
Detections are an event that looks like transforming the data (including the
anomalous or malicious. And the issue data fusion) to create context for the data,
today in a modern Security Operations i.e., enrichment with threat intelligence,
Center (SOC) is that detections can bubble location, asset and/or user information.
up from many siloed tools. For example,
a firewall and Network Detection and
Response (NDR) for network protection,
The main purpose of SIEMs is to
Endpoint Detection and Response (EDR) collect and aggregate data such
for endpoints’ protection and Cloud as logs from different tools and
Application Security Broker (CASB) for applications for activity visibility
your SaaS applications. Correlating those and incident investigation.
detections to paint a bigger picture is the
issue, since hackers are now using more
complex techniques to access your
applications and data with increased
attack surfaces. The security team is either
claiming false positives or an inability to see
NEW IDEAS, NOT HYPE Gartner, as an example from their Fall
2019 Security Summit, their number two
security applications in a single platform.
The SIEM should be one of many such
trend, out of 7 Top Security and Risk natively- supported applications among
Management Trends for 2020, is a many others, including User and Entity
renewed interest in implementing or Behavior Analysis (UBA & EBA), Network
maturing SOCs with a focus on threat Traffic Analysis (NTA) and Firewall Traffic
detection and response. They further note, Analysis (FTA), threat intelligence, etc.
“In response to the growing security skills
gap and attacker trends, Extended
Detection and Response (XDR) tools, XDR is a cohesive security
Machine Learning (ML), and automation
operations platform with tight
capability are emerging to improve security
operations productivity and detection
integration of many security
accuracy.” It also published Innovation applications in a single platform.
Insights for XDR on March 19, 2020.

XDR is a cohesive security operations

platform with tight integration of many
 WHAT MAKES All thought leaders agree: Gartner,
Forrester, ESG, IDC and Omdia all say
Tools need to look at correlating
XDR DIFFERENT? there are silos and gaps in today’s SOC.
Tools need to look at detections across detections across network, cloud,
network, cloud, endpoints and users. All endpoints and users as a true
analysts talk about the idea of correlations indicator of XDR capability.
across these areas as a true indicator of
XDR capability. As an example, your SIEM
sees a log telling you a user has accessed seconds — instead of hours or days as seen
SQL at a time of day that is not typical, your in many SIEM-only products. The same
NTA tool tells you that the user is sending software can be deployed on-premises
the traffic outside your country, and your with hardened physical appliances, virtual
UBA tool tells you that additionally, the machines, private or public cloud with
user has not typically used this app at those horizontal scalability and high availability
times or at those data rates. This paints a capability, key to big data analytics running
picture of a complex attack, yet siloed tools on an open data lake. These characteristics
need manual intervention to draw the are also critical for the ever-increasing data
conclusion. Today’s XDR systems can paint volumes and compliance requirement of
this picture automatically through AI/ML. zero data loss.

XDR is developed using new cloud-native

architecture and services including micro
services-based architecture with containers
and clustering. It is very flexible in terms of
deployment, scalable in performance coupled
with a Lucene-based search engine to make
the query of information super-fast — in
COMPARISON OF XDR AND SIEMS:

XDR SIEMs
• A single cohesive security operations • A standalone platform mainly
platform across endpoints, networks, for log management and compliance
applications and cloud • Add-on security tools such
• Many native-supported security applications as EBA and UBA, NTA, etc.
• Challenges of manual correlation
of security events

• Automatically correlating security events • Primary use cases are still for
from many security tools log management and compliance
• Automatic threat detection and incident • Correlations across tools
response use cases and telemetry are manual
• Automatic and fast threat hunting with a • Threat hunting with many SIEM tools
big pre-built library of threat hunting apps is manual and very slow

• Cloud-native architecture drives flexible • Queries take hours or days

deployment, scalable performance in SIEM-only products
• Queries are super-fast—in seconds—
through Lucene-based search engine
FIVE FOUNDATIONAL
REQUIREMENTS OF XDR SYSTEMS:
FOUNDATIONAL REQUIREMENT XDR SIEM

Normalized and enriched data from variety

1
Open architecture, Open to integrate
of data sources including logs, network traffic,
all data, any source but manual
applications, cloud, Threat Intelligence etc.

Manual or through complicated

2
Automatic detection of security events from the data
and expensive add-on applications
collected with advanced analytics such as NTA, UBA and EBA
like UEBA

3
Correlation of security data Integrated, Manually constructed
and alerts into incidents adaptive policy rules

4
Incident response capability that changes Open ecosystem, Complicated and expensive
the state of individual security products automated add-on tools like SOAR, IR, etc.

5
Cloud-native micro-services architecture Legacy and outdated
for flexibility, scalability and high availability architecture or databases
ONLY STELLAR CYBER AUTOMATES DETECTION,
CORRELATION AND RESPONSE ACROSS CYBER KILL CHAIN

Why Stellar Cyber’s Open XDR?

• Automatic threat detection and incident response
by correlating security events from any security tool,
through two-tiered machine and adaptive learning
to ensure the critical detections are acted on

• Producing higher-fidelity alerts, reducing false

positives, and supercharging analyst productivity

• An open ecosystem to ensure leverage of existing

security tools and best practices, reducing risk
without disruption, and improving the fidelity
of all your existing tools