Evaluate SIEM, Event & Log Management Solution

How do you evaluate a Security Information and Event Management Solution For your Company.

Below are the questions you need to ask yourself because buying a SIEM Solution.

Threat identification: Raw log form vs. descriptive.
Threat tracking: Ability to track through the various events, from source to destination.
Policy enforcement: Ability to enforce defined polices.
Application analysis: Ability to analyze application at Layer 7 if necessary.
Business relevance of events: Ability to assign business risk to events and have weighted threat levels.
Measuring changes and improvements: Ability to track configuration changes to devices.
Asset-based information: Ability to gather information on devices on the network.
Anomalous behavior (server): Ability to trend and see changes in how it communicates to others.
Anomalous behavior (network): Ability to trend and see how communications pass throughout the network.
Anomalous behavior (application): Ability to trend and see changes in how it communicates to others.
User monitoring: User activity, logging in, applications usage, etc.

Some questions you also need to ask your teams about Data Collection and Assest Management.

What devices would be candidates for log and event collection?
What policies would you like to track?
What information would you like to have available if a threat or vulnerability was identified?
What sort of devices and information would be valuable for your area, in terms of asset collection?
What length of time for access to current/archival information is acceptable?



I got this list of questions off some RSS feeds and cannot remember the source.