• Watch
  • Listen
  • Live Stream
Security Weekly
Security Market Validation
  • Listeners
    • Subscribe
    • Insider List
    • Suggest a Guest
  • Shows
    • Paul’s Security Weekly
    • Enterprise Security Weekly
    • Business Security Weekly
    • Application Security Weekly
    • Security & Compliance Weekly
    • Security Weekly News
    • Tradecraft Security Weekly
    • Secure Digital Life
  • Series
    • CISO Stories
  • Webcasts/Trainings
    • Registration
    • On-demand
  • Articles
  • Partners
    • Become a Partner
    • Landing Pages
    • Bookings
      • Approved Interview Form
      • Approved Interview Form – Returning Guest
      • Conference Collection Form
  • Hosts
  • Company
    • About
    • Contact
    • Careers

Articles/ Blue Team/ Endpoint Security/ Firewall/ Incident Response/ Intrusion Detection/ Managed Security Services/ Patch Management/ Security Operations/ SIEM/ Threat Intelligence/ Vulnerability Management

Selecting the Right Brain for Your Sensors

Matt Alderman January 12, 2021

Last fall we discussed what security data do I really need to collect and analyze.  We know we don’t need it all, but this was only the sensor part of the discussion.  Now that we have that data identified and those sensors in place, what brain do I need to collect and analyze it?

There are many security incident and event management (SIEM) solutions on the market today, which is the primary security brain for most organizations.  Next generation SIEM products, along with legacy SIEM products, are fighting to be the dominate solution for security operations.  So how do you choose the right product?

We interviewed Patrick Orzechowski, Vice President of Research and Development from deepwatch, on Business Security Weekly to discuss their selection criteria for selecting their brain, Splunk.  We started with some of the key capabilities needed for their offerings, including:

  • Time to value – The ability to quickly install and provide value to their customers
  • Data schema – The ability to centralize data without needing to understand the data model
  • Free text search – The ability to quickly search for data without understanding a query language

Splunk provided these capabilities with various deployment models to support their deployment models – cloud, on-premise, or deepwatch hosted.  Also, by standardizing on a single solution, deepwatch can deliver the following benefits and value for their customers:

  • Economy of scale – By crowd sourcing searches across all of their customers, deepwatch can quickly address new threats
  • Flexibility – With a standard ingest, analytics, and reporting platform, customers can choose any sensor
  • Human advantage – With deepwatch’s squad model, their analysts verify alerts and remove false positives

To get a deeper dive, watch the interview on Business Security Weekly here, watch their on-demand webcast, How to Measure Security Operations Effectiveness, here, or visit securityweekly.com/deepwatch for more information.

Share this:

  • Click to share on Twitter (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Facebook (Opens in new window)

Related Posts

linux security

Articles /

How to Defend Linux from Attacks

tea leaves

Blue Team /

Reading the Application Security Tea Leaves – How to Interpret the Analyst Reports

unnamed

Endpoint Security /

Building A Truly Unified Endpoint Data Platform

‹ Security Awareness Training – Time for a Change in Philosophy? › How Behavioral Detections Actually Discovered the SolarWinds Orion SUNBURST Attack

About Security Weekly

Security Weekly is the security podcast network for the security community, distributing free podcasts and media since 2005. We connect the security industry and the security community through our security market validation programs.

More Than Just A Sponsor

We view our relationships with the security industry as partnerships, not sponsorships. Security Weekly works closely with each partner to help you achieve your marketing goals and gain traction in the security market. Interested in becoming a partner? Please visit our partnerships page.

Back to Top

Subscribe To The Blog:

RSS Feed RSS - Posts

Search

Follow Us On Twitter

→ Follow Us
© Security Weekly 2021
Powered by WordPress • Themify WordPress Themes