This Hash-Time Breakdown focuses on cyber security solution scoping, specifically, when deciding if you need a Security Information and Event Management (SIEM) device or not. Also which SIEM should you choose for your environment. Common questions covered include the following:
- What are you trying to accomplish?
- What do you have now?
- Cloud vs on prem vs hybrid
- EPS, bandwidth utilized
- Data source scoping – what’s important?
a. what do you have
b. is it compatible
- What is an egress point from an architectural standpoint and why does it matter?
- Compliance and storage
- Decryption
- Cloud packet capture plugins