The Operational Role of Security Information and Event Management Systems
Security & Privacy, IEEE （2014）
摘要
An integral part of an enterprise computer security incident response team (CSIRT), the security operations center (SOC) is a centralized unit tasked with real-time monitoring and identification of security incidents. Security information and event management (SIEM) systems are an important tool used in SOCs; they collect security events from many diverse sources in enterprise networks, normalize the events to a common format, store the normalized events for forensic analysis, and correlate the events to identify malicious activities in real time. In this article, the authors discuss the critical role SIEM systems play SOCs, highlight the current operational challenges in effectively using SIEM systems, and describe future technical challenges that SIEM systems must overcome to remain relevant.
更多查看译文
关键词
business data processing,computer network security,digital forensics,system monitoring,SIEM systems,SOC,computer security incident response team,enterprise CSIRT,enterprise networks,forensic analysis,malicious activities,real-time security incident identification,real-time security incident monitoring,security information and event management systems,security operations center,SIEM,SOC,alerts,events,security,security information and event management,security operation center
AI 理解论文
溯源树
样例
生成溯源树，研究论文发展脉络
Chat Paper
正在生成论文摘要