The breakup: Why CISOs are decoupling data from their SIEMs | TechTarget
The traditional enterprise SIEM pulls security log data from sources across the IT environment, then normalizes it, analyzes it and retains it. But because SIEM providers typically charge more to hold more data, organizations generally must retain less data than they would prefer and accept the limitations of subsequent analyses.
Additionally, SIEMs retain data in their own, often proprietary formats. In fact, how SIEM vendors parse and normalize data is one way they differentiate themselves from competitors. Each seeks to use unique schemas, compression techniques and specialized databases to improve both result quality and speed. Consequently, enterprises have limited input into how their data is ingested and digested, and proprietary parsing and formats can make it harder to change vendors.
Some CISOs -- finding the limitations and trade-offs of data ingestion and retention in SIEM too constricting -- are choosing to decouple their security log data feeds from their SIEMs....
Copyright of this story solely belongs to techtarget.com. To see the full text click HERE
