XDR Cybereason and the SOC triad – SIEM

Organizations have had a problem with prioritizing the implementation of new technologies for a long time. Since the pandemic, the catalyst for digital transformation, they have a huge problem with it. At the beginning of our article series, we talked about the SOC triad – NDR, EDR and SIEM. So far, we have only seen attempts to prioritize NDR as an overarching technology. However, thanks to Cybereason, it turns out that the vendors coming from the EDR level did not say the last word … Below are some arguments that support starting the implementation of the SOC triad from EDR-based technology, which combines some NDR and SIEM functionalities. That is why it successfully competes with the entire SOC stack.

When it comes to competing with SIEM it is worth to look at Cybereason because …

1. For many organizations it is too early to SIEM…

Even a medium-sized organization can have hundreds of different varieties of operating systems, applications and network devices, creating the monumental task of collecting all data in one place and normalizing it (bringing different logs to one standard). In addition, the pace at which companies develop IT, devices and applications means that teams supporting SIEM are often simply not keeping up.

2. SIEMs lack automation

When you look at hundreds of different devices, each with its own way of communicating what’s going on – it’s hard to enter a precise query. Of course, you can set some rules, such as “tell me when you see five failed logins followed by successful login.” But it does require knowledge of building SIEM queries. It is beyond the power of any SIEM to correlate all of these dissimilar events across platforms later and to draw meaningful conclusions.

3. Scalability of SIEMs

Collecting, normalizing, categorizing, analyzing, reporting and archiving data from tens or even hundreds of thousands of events per second requires a lot of computing power, processor, memory and I/O operations. None of the SIEM players came out with a technology that can analyze in real time and quickly retrieve data when needed, and also store it efficiently.

4. Insufficient visibility

Nobody uses SIEM to understand what is happening on the endpoints – which is where hackers do most of their work. Currently, no SIEM system can handle the amount of logs needed to analyze endpoint data. So when the endpoint is outside the corporate network – as is often the case with remote and traveling employees these days – your visibility is zero.

Considering the above, you should consider whether you have sufficient human capital resources to ensure the successful implementation of SIEM technology. Compared to the typical Security Information & Event Management Cybereason will allow you to get:

1. Visibility. Cybereason’s endpoint sensors monitor – in real time – every process, every connection, every user on every endpoint across the enterprise, whether it’s a server at your company’s headquarters or a Starbucks laptop with Salesforce access.

2. A real behavioral analysis with Cybereason’s Hunting Engine. It collects all data from endpoint sensors and uses a specially built graph to identify threats. Hunting Engine analyzes real-time and uses machine learning as well as statistical and behavioral analysis to achieve unparalleled detection of all elements of an attack, especially zero-day threats.

3. Ease of implementation. Cybereason was designed from the ground up to be easy to implement. Cybereason’s Endpoint Sensor works in the user space, eliminating the risk of a “blue screen” and making deployment exponentially easier. Cybereason servers operate in the cloud or on-premises, depending on your preferences, reducing the time you plan to deploy. Finally, Cybereason comes preconfigured with behavioral models so you can get value immediately after sensor insertion.

4. Ease of implementation. Cybereason was designed from the ground up to be easy to implement. Cybereason’s Endpoint Sensor works in the user space, eliminating the risk of a “blue screen” and making deployment exponentially easier. Cybereason servers operate in the cloud or on-premises, depending on your preferences, reducing the time you plan to deploy. Finally, Cybereason comes preconfigured with behavioral models so you can get value immediately after sensor insertion.

5. Automated response. Unlike SIEM, with Cybereason, when you identify a threat, you can automatically disable it, prevent it from spreading to other places, isolate it, and perform a complete remote forensic analysis on your computer.

Our customers tell us that they spend less money, less time and effort, and get far more benefits from the Cybereason platform than any other tool they have implemented – including SIEM. Sure, if you have nothing else to give you an insight into what is happening in your environment, SIEM is a milestone. But remember that SIEM is a multiplier of the value of each security technology – only through time-consuming integration can you get real value.

And anyway, sooner or later most people start to question the value they get, given the money and effort they put into SIEM implementation …