How to Migrate Your Legacy SIEM

This prioritization should rely on your latest risk assessment so that high-risk actions with substantial impact on business operations are completed. Identify relevant stakeholders and receive a mutual agreement on your priorities. After prioritization, you must document the problems that you are trying to solve through SIEM migration. These use cases must cover people, process, and technology and be in line with business objectives. For these use cases to function, identify various data sources that will feed log data to your new SIEM solution. It would be best if you asked your SIEM service provider about inbuilt use cases and available data sources with their platform.

Closely coordinate with your SIEM service provider accurately configure data sources into your new SIEM solution. A good SIEM solution will feature inbuilt support for a wide range of log data sources and require minimal manual parsing of log data fields. Logsign SIEM supports more than x+ data sources to help our customers quickly set up their SIEM solution. Not only can they request new parsers, our support team also assists in building customized parsers to suit your requirements. As a sub-process of execution, you may need to train your SOC team to be familiar with a new SIEM solution and operate it effectively. While a new SIEM solution will increase the productivity of your team, you must ensure that the transition takes the least amount of time possible. The duration of this step is directly proportional to the number of use cases and data sources.

An organization needs to ensure that the new SIEM solution is performing as expected and discovering threats and suspicious behavior. We recommend our clients to have an overlapping period before they stop using legacy SIEM in totality. In this step, you need to set a baseline to assess the performance of new SIEM solution. This baseline depends on factors such as the fulfilment of compliance requirements, percentage of false positives, the scope of event correlation, etc.

Using machine learning algorithms and behavior analytics, it will minimize the percentage of false positives. However, before signing off the SIEM migration project, your organization must decide on a specific duration for conducting regular reviews. These reviews should focus on reviewing the existing use cases and creating new use cases to match business requirements. We recommend performing this exercise every quarter. An ideal suggestion at this point is to perform red team exercises to check how your SIEM solution reacts. In case your organization does not have a dedicated team for red team exercises, you should consider engaging with an independent third-party. From this point on, improving your SIEM solution with regular reviews should become a part of your continuous improvement process.