SIEM platforms are critical to maintaining robust cyber defences. They allow teams to build use cases, ingest data, and build the necessary tools like searches, alerts and visualisations that help organisations spot potential threats. As SIEM has evolved, it became commonly used in tandem with other technologies like SOAR, allowing teams to automate responses, integrate workflows, and provide insight that helps proactively stop incidents before they can cause damage.

Now next generation SIEM is taking SIEM solutions a step further, imbuing them with new features and cutting-edge technologies like AI.

Let’s take a look at how next gen SIEM’s are changing things for the better.

What does next gen SIEM do differently?

No limitations on data collection

Since newer technologies—such as Data Streaming Processors like Cribl and Splunk Edge Processor— have become available, we can now remove limitations on the amount of data that can be collected.

Previously, limitations meant we could only collect enough data to fulfil use cases, which sometimes led to events being missed or restrictions being placed on what we could see. DSP technology allows us to collect unlimited data and send it to multiple destinations, meaning data managements is simpler and we’re no longer hampered by narrow data sets. DSP also allows data to be routed to multiple locations, including data lakes and SIEM, getting data where it needs to be faster.

DSP also help reduce storage costs, with these solutions bringing significant savings either through a number of routes. Implementation of data storage processes, where, for example, data is subject to a lifecycle policy and is automatically sent to a cheaper storage location until it’s required, can make a big difference to hosting costs. These policies are also great for helping organisations adhere to regulatory requirements.

Reduces workload for team members

When it comes to new technologies, evolving skill sets are not always a top talking point. But as we move to the next generation, the wave of new skill sets required to operate next gen solutions is widening the skills gap further. Security engineering in the SOC/SIEM space requires a broad set of security operations skills, as well as DevOps skills. Although this may cause an issue for some teams that don’t have a continuous learning culture in place, the benefits that next gen solutions bring can actually offset some of that skills requirement.

Next gen SIEM offers advantages like reducing human error, lowering time-to-deliver responses, faster installations, and the ability to automate configurations, which take some of the burden away from team members and eliminates at least some of the manual workload.

Better utilises the tech

Next gen SIEM ingests data feeds from a lot of different solutions including endpoints, cloud and

solutions, and network devices. However, the difference with a next gen SIEM is how these products manage configurations items.

Take EDR, for example. Technologies such as Crowdstrike are the workhorse behind detection and the response, using signals to respond correctly to any possible threats or anomalies. Previously, EDR solutions would be limited in what they could do and the information they could log, but now the data feed from the EDR is far more focused, and can be sent to the SIEM based on events and responses so that it can be used more intelligently.

The SIEM can then use other data and context to enrich this info from the EDR, learn from past events, and detect and prevent a similar attack in the future.

Integration with SOAR

Fast remediation of a security incident is key to an effective SIEM. And with next gen SIEM offering richer data sets that provide greater insights about events, we can be much better informed—and able to facilitate faster responses.

Next gen SIEMs take signals not only from its organisation, but also wider industry sources. This gives teams the information they need to automate responses, and provides the SIEM with the right data to isolate and minimise the radius of the potential damage during an attack.

Built-in AI and machine learning

AI and machine learning are hot topics in the tech space, so it’s no surprise that next gen SIEM platforms benefit heavily from these technologies. Next gen SIEM makes use of complex data sets and models. These colossal models not only help organisations identify and respond to a massive range of attack and threat types, but they also evolve over time, continuously learning from new events and adapting to protect against them.

AI allows teams to boost speed and accuracy their threat detection processes, giving them more coverage and allowing them to respond faster than they could possibly otherwise. These smart, automated sentries not only help stop attacks in their tracks, but they also provide SOC Analysts with much better insights and frees them to focus on other tasks.

AI also empowers teams to be more productive. Search engines powered by natural language processing and AI-generated recommendations make the SOC Analyst role much more intuitive. Complex queries can be executed faster over larger data sets, and the ability to reverse queries helps Analysts get up to speed with query language much more quickly and reduces knowledge gaps within the team.

Smarter behavioural analytics and UEBA

Traditional UBA (user behaviour analytics) allowed Analysts to track, collect, and assess user data and activities within the IT infrastructure. Despite being incredibly useful in its day, UBA has become outmoded, being widely overtaken by UEBA, which also monitors the ‘behaviour’ of devices and applications.

UEBA uses a mixture of machine learning and data to help spot unusual patterns of behaviour among networks, applications and users, measuring activity against predetermined baselines to help teams identify potential attacks or other unauthorised actions.

Next gen SIEMs can be used alongside UEBA to learn even more from this behavioural data. Teams now have the ability to analyse and understand the behaviours of dynamic teams and groups, learning from collective behaviour and using it to generate new baselines. For example, if a user from a particular team accesses a file which it doesn’t normally access, it may be flagged by the UEBA solution. However, with the next gen ability to learn from group behaviour, the solution can look at what’s normal for the team, not just the individual. If other members of that team access the file regularly, then it’s likely that this is a normal behaviour—perhaps this individual is just new to the team and hasn’t access the file before.

In this case, the system will have learned that this is usual behaviour for this team, and won’t trigger an alert. This can help reduce alert fatigue and help Analysts focus on the most pressing and relevant alerts.

Is it time to upgrade to a next-gen SIEM solution?

Cyber attacks are constantly evolving. To protect your organisation from innovative threats, you need innovative security solutions.

As experienced cyber security experts, we can help you implement or upgrade to a next-generation SIEM tool that uses machine learning and threat intelligence to detect suspicious activity.

Upgrade your SIEM and get next-generation protection today