What is SIEM?

If you’ve taken a dip into the world of cybersecurity, you’ve likely heard of SIEM — often pronounced “sim.” SIEM stands for Security Information and Event Management; SIEM solutions collect data that help IT admins analyze the behavior of their system. This can include things like:

• Suspicious events, like unusual login location or time
• Network activity
• Data from servers, firewalls, computers, applications and so on

SIEMs digest this data and make it easier for IT and Security teams to understand and work with. This could include dashboards, charts, graphs and more. SIEMs also notify admins when something looks amiss, helping them stay up to date with the condition of their systems and act quickly if need be.

Why is SIEM important?

The information gathered by a SIEM solution is valuable for IT and Security teams because it helps them understand what is going on with their infrastructure. It’s especially useful in the event of a cyber attack, as this data can help them determine the timeline and method of the attack, as well as the affected systems. Data from one part of their infrastructure can be correlated with others, giving admins a more thorough picture of the attack.

Understanding what happens when your organization is attacked isn’t really just a “nice-to-have” feature — it’s crucial to keep your information secure. Attacks show where your systems are vulnerable, and the data processed by SIEMs can help inform how you reinforce your security posture.

Data processing

SIEMs act as a central place for data collection, storage and analysis — meaning less work for IT and Security teams that need to understand the data. If your organization’s CISO or other executive needs a security report, SIEMs make it easy to pull the necessary data and present it in a digestible form, whether for a technical or non-technical audience.

SIEMs use machine-based sorting to classify telemetry data. When the SIEM detects potential threats and/or vulnerabilities, it categorizes them based on their severity and impact. This way, IT and Security teams can prioritize their response according to the potential consequences of the event.

Threat detection and incident response

When SIEMs leverage machine learning, they can be a powerful tool to spot advanced threats — including those that haven’t been discovered by the cybersecurity community. Since SIEMs are a centralized processor of data, they can correlate events that happen in separate parts of your system. This contributes to SIEMs’ ability to interpret suspicious activity; this activity may seem relatively innocent on its own, but when associated with other events, the data start to show indicators of malicious activity.

Compliance

SIEMs are a great tool to determine your devices’ compliance status. They can create reports for use in a compliance audit, for regulations like:

• HIPAA: The US Health Insurance Portability and Accountability Act protects medical records and other personal health information.
• PCI DSS: The Payment Card Industry Data Security Standards protect data related to credit card use.
• GDPR: The EU General Data Protect Regulation governs how personal data is handled, giving users more control over their personal information.
• SOX: The US Sarbanes-Oxley Act mandates how to handle financial information.
• FERPA: The US Family Educational Rights and Privacy Act governs how student information can be accessed.

SIEMs and Mobile Device Management

Notifications and alerts from SIEMs tell admins when to take action. Remediating issues doesn’t happen within the SIEM — that’s where Mobile Device Management (MDM) comes in.

Organizations can integrate their SIEMs and MDM systems to correlate with inventory data and for incident response. For instance, say your SIEM identifies that a device has a vulnerable software version. With this data, your MDM can take action and update the software to help restore the device’s compliance status. MDMs also offer SIEMs rich inventory data that can be correlated with other events.

How are SIEMs relevant for Jamf customers?

Powered by Jamf Threat Labs, Jamf Protect captures detailed information about an organization’s devices. Jamf Protect:

• Monitors on macOS for suspicious events
• Detects threats
• Provides advanced security telemetry
• Checks for device compliance

Data from Jamf Protect can directly feed into Jamf Pro, which can help devices return to compliance. This can all be done automatically, saving admins’ time and restoring security quickly and efficiently.

Integrating your SIEM with Jamf Protect gives admins robust insight into the health and activity of their devices. Jamf integrates with these popular SIEMs:

• Splunk
• Google Chronicle
• Microsoft Sentinel
• Elastic
• Data Dog
• Sumo Logic
• Panther