- [Narrator] You already know that log files
are an important security control,
allowing IT professionals to detect suspicious activity
taking place on their systems, networks, and applications.
However, if you're like most security professionals,
you simply don't have the time to do a thorough job
of reviewing those logs.
There are far too many log entries generated
by systems everyday and trudging through them
would be tedious, mind-numbing work.
Fortunately, computers are very good at tedious work
and most organizations now go beyond the simple reporting
and alerting mechanisms that I described in the last video
and apply artificial intelligence based approaches
to the problem of security log analysis.
Security Information and Event Management or SIEM systems
have two major functions on an enterprise network.
First, they act as a central, secure collection point
for log entries.
Administrators configure all of their systems,
network devices, and applications to
send log records directly to the SIEM
and the SIEM stores them in a secure fashion
where they are safe from unauthorized modification
and available for analysis.
Second, these systems apply artificial intelligence
to correlate all of these log entries
to detect patterns of potential malicious activity.
The great thing about a SIEM is that it has access
to all of the log entries from across the organization.
In a hierarchical organization network engineers
might have access to firewall logs.
System engineers might have operating system logs
and application administrators may have application logs.
This siloed approach means that attacks
may go unnoticed if the signs of the attack
are spread across multiple departments.
Each administrator may see a piece of the puzzle
but can't put the whole picture together.
The SIEM has all of the puzzle pieces
and performs an activity known as log correlation
to recognize combinations of different activities
from different log sources
that together may indicate a potential security incident.
For example a firewall may note an inbound connection
to a web server from an unfriendly country.
The web server may report suspicious user requests
that include signs of a SQL injection attack.
The database server might report a large query
from a web application that deviates from normal patterns.
And a router might report a large flow of information
from the database server to the internet.
In isolation each of these activities may seem innocuous
but when the SIEM puts those pieces together,
a pattern of suspicious activity emerges.
Security Information and Event Management systems
provide security professionals with a valuable tool
for the centralized collection and correlation
of security log information.