Legacy SIEMs are Stuck in the Past

 

Finding a mechanism to collect, store and analyze security only data is relatively simple. There is no shortage of options for storing data. Collecting all security relevant data and turning all that data into actionable intelligence, however, is a whole other matter.

Many enterprise IT organizations that invested in security event information management (SIEM) platforms have discovered this fundamental truth the hard way. After spending a significant amount of time and money to record security events, the trouble is that not only did it take a long time to ingest all that data, but the underlying data system used to create the SIEM tends to be static.