The SIEM is a central point where data is collected and correlated, and as we move to consume more cloud services and data sets the SIEM itself must also change in architecture. Architecture change is hard to make for existing products. Calling a product a ‘cloud solution’ is not the same as taking an on-premises product and hosting it for customers. It means building a new SIEM for a new world. There are a lot of reasons users seek new SIEMs.

Cybersecurity is front and center today for every business regardless of size or industry. Major ransomware attacks and data breaches seem to make headlines just about every day. Sophisticated attackers and cybercriminals are always finding new ways to extort businesses, steal confidential data, and wreak havoc. A quick read of the CrowdStrike 2021 Global Threat Report will surely give you cause for concern.

I’m a security analyst at Orange Business Services in Paris, and one of my current projects for the Orange Group is implementing a new SIEM based on the Elastic Stack. In this blog post, I’ll share why we chose Elastic and how we were able to integrate Elastic into our existing SIEM, resulting in faster investigations and saving our engineers’ time. So follow along.

Today’s enterprise networks are heterogeneous, have multiple entry points, integrate with cloud-based applications, offer data center delivered services, include applications that run at the edge of the network, and generate massive amounts of transactional data. In effect, enterprise networks have become larger, more complex, and more difficult to secure and manage.

Security Information and Event Management (SIEM) is a combination of Security Information Management (SIM) and Security Event Management (SEM). A SIEM solution provides real-time analysis of security alerts generated by applications and networks. SIM is the collection, monitoring and analysis of security-related data such as log files into a central repository for trend analysis.

It has been off to the races for the Sumo Logic and AWS teams since the general availability of the Sumo Logic Cloud SIEM powered by AWS solution on June 1, 2021. We are excited for the overwhelming response from customers from across all segments, industries and geographies.

Today, we’re excited to announce that ManageEngine has been recognized in 2021 Gartner Magic Quadrant for security information and event management (SIEM) for the fifth consecutive time. We are thrilled to be awarded this recognition yet again for our contribution to the world of cybersecurity. “Most enterprises were not prepared for the widespread changes in work environments following the COVID-19 pandemic.

Crowdstrike is an innovator in the endpoint protection market with innovative approaches for the last decade. They specialize in depth of data collection and have uncovered many forensic mysteries in security over the last 10 years. We have many mutual customers with CrowdStrike, which is why we began working with them on a solution to analyze and correlate their data within Logz.io.