SIEM selection criteria for an efficient contextual security
Nabil Moukafih, Sabir Soukainat, Abdelmajid Lakbabi, Ghizlane Orhanou · 2017
The IT environment is on a constant evolution and it's getting more complex. Therefore, organizations started to invest on integrating SOCs (Security Operation Center) to improve its security. Several studies have been carried out on this area of SOC analysis, its elaboration and the balance between the triad PPT (Person, Process and Technology). Our aim in this paper is to propose selection criteria that will help organizations analyzing different SOCs and perhaps chose the ideal one. In this context, we have implemented three SIEM tools and compared them through the proposed criteria, in order to demonstrate how much information these criteria can provide on each SIEM tool, and thus contributing in decision making for choosing the ideal SOC for a specific environment.