PwC SIEM Health Check
21 October, 2019
Qualitative analysis of SIEM systems
The SIEM Health Check service consists of a comprehensive analysis of the current state of the implementation of the client’s SIEM solution. The service is vendor agnostic – it can be applied to any SIEM product. As part of the service, a set of dedicated checks is performed.
Checks are grouped into following areas:
- Architecture – assess if the current architecture of the SIEM system reflects vendor’s requirements and industry best practices, check if it meets client’s needs and PwC recommendations.
- Data Sources – assess the completeness and quality of data sources currently connected to the SIEM and the procedures related to the tracking of the data sources statuses.
- Functional Configuration – assess the quality of the functional configuration of the SIEM.
- License and current usage – assess the operational usefulness of the current state of SIEM and the status of the license
Service purpose and benefits
The purpose of the SIEM Health Check service is to provide knowledge about the quality of the existing implementation of SIEM system and help to understand what areas are to be improved.
Specifically, the service covers following aspects:
- Identification of potential issues and bottlenecks related to the architecture, evaluation of their impact on the system and recommendation how to resolve them.
- Assessment of current coverage of data sources, identification of potential issues related to it (for example improper data coverage, loss of log events, improper data filtering) and recommendation how to resolve them.
- Assessment of the functional configuration of the SIEM. Evaluation of the quality of currently implemented use cases (correlation rules and other detection mechanisms), reports, dashboards, alerts et cetera, and recommendation how to resolve potential issues.
- Assessment of the current usage of SIEM system across the organization in order to help to understand how it is used by SOC, security department and other potential stakeholders.
- Evaluation of current license usage and identification whether SIEM costs correspond to value that SIEM logs bring to SOC operations.
Engagement outcomes
As a result of the service a comprehensive report is provided consisting the summary of performed checks, conclusions and recommendations.
The checks
- Architecture
- Data sources
- Functional configuration
- License and current usage
Architecture
The goal of these checks is to assess of the current architecture of the SIEM system. Specifically, checks include the analysis of:
- Overall SIEM architecture.
- Design and the implementation of the core system components.
- Design and the implementation of the data collection layer components of the system.
- Performance of the SIEM system components.
- Design and the implementation of the backup process.
- Configuration of the communication between SIEM components.
- SIEM components updates availability
- Logs of the SIEM system components in order to identify any architecture-related issues.
Data sources
The goal of these checks is to assess the completeness and quality of data sources currently connected to the SIEM. Specifically, checks include:
- Evaluation if the Master Log Requirement (MLR) document is already defined/implemented.
- Evaluation if the list of most valuable IT assets is already defined and maintained (so called “Crown Jewel” assets, SOX, ICOFR and GDPR related assets).
- Analysis of audit logs configuration on data sources.
- Analysis of event filtering in terms of the license usage
- Analysis of data sources tracking process.
- Analysis of additional SIEM data feeds (for example blacklists with TOR IP addresses, threat intelligence feeds).
- Analysis of custom data source parsers and identification of log parsing issues.
- Review of logs of the SIEM system components in order to identify any data sources-related issues.
Functional configuration
The goal of these checks is to assess to quality of the functional configuration of the SIEM. Specifically, checks include:
- Analysis of currently implemented use cases/correlation rules.
- Analysis of statistics for the currently implemented use cases.
- Evaluation of the quality and performance of currently implemented dashboards.
- Evaluation of the quality and performance of currently implemented reports.
- Evaluation if there are external threat intelligence feeds or other custom lists already integrated in order to enrich the SIEM content.
- Evaluation if there is an integration with any of customer’s third-party systems, for example CMDB, ticketing systems.
License and current usage
The goal of these checks is to assess the operational usefulness of the current state of SIEM and the license usage. Specifically, checks include:
- Analysis of SIEM solution usage on a daily basis.
- Evaluation if there are IT incidents raised based on information generated by the SIEM solution.
- Analysis of purchased SIEM license/subscription.
Related content
Follow us
Contact us
Daniela Geretshuber
Member of the Board and People and Corporate Sustainability Leader, PwC Germany
