I will certainly confess, when asked what you must utilize as the core technology to understand your organization’s cybersecurity risks, a data warehouse is not normally the initial device that enters your mind.
Typically your impulse will certainly press you in the direction of conventional SIEM (Security Info as well as Event Administration) systems, nevertheless these systems are function constructed to do this kind of help you.
Nonetheless, let’s take a step back momentarily. SIEMs are terrific at funneling data in and providing you with a base set of regulations that work for everybody, yet what eventually winds up occurring is that you obtain shed in an ocean of false positives that your bad SecOps team currently needs to filter through, instead of doing more crucial stuff like making sure genuine issues are attended to, and also enhancing your general safety and security ground.
Why is this though? What is missing that is causing all of these false positives?
The issue with conventional SIEMs is that they are missing context. As an example, is this a Sandbox equipment, is that individual a DevOps user who is suggested to run unknown applications, is this security group expected to be open because it becomes part of a DMZ?
Adding this context to a traditional SIEM is an obstacle to maintain as normally the SIEM is taken care of by a different team than the one that is using AWS, for instance. This causes incongruities in context as viewed from both teams, therefore resulting in more incorrect positives, and also unclear removal paths (and also sad faces).
Security is a Data Problem
Like whatever else in the data world, the quantity of safety and security data is increasing, and its value is multiplied when it is joined with other contextual information sets. This is really where an information storehouse comes to be a lot more pertinent in the safety analytics space. Nonetheless, this has traditionally been an overwhelming job with the requirement to model the events in advance, incorporate every one of the data sources, as well as have the ability to handle the semi-structured nature of most of the events. There is extra intricacy when you are attempting to evaluate across SaaS and Cloud systems, as their data is normally API driven as opposed to log documents driven.
Enter Snowflake Cloud Data Warehouse
With Snowflake security indigenous capacity to deal with semi-structured data, it is an all-natural option for examining your safety and security data. Nevertheless, the attribute that makes this much more powerful is Snowpipe with car consume, streams and jobs.
SnowAlert
We have actually discussed SnowAlert before, but I wished to put it in the context of this SIEM substitute method. SnowAlert permits a user to create signals as well as violations. Alerts are tasks that need focus at this minute, or stated one more method, events that were caused as the result of some activity.
The very best component about all of this is that the regulations (offenses, alerts, as well as particular suppressions) are defined in SQL, a tidy and clear method to specify, define and model your policies. Furthermore, SnowAlert integrates with Slack as well as Jira for event monitoring too.
Data Sharing
One essential item of contextual info that has not been discussed yet, is exactly how do I incorporate with curated lists of IOC’s (Indicators of Compromise), where do I obtain them from.
This is where Snow Information Sharing as well as Information Exchange can be found in. You can now obtain a listing of IOC’s as if you were getting an Application from the AppStore. The most effective component is it just appears as one more table, that gets updated without you having to do anything. This indicates you don’t have to remain on top of the current safety projects, so long as you have a share arrangement from a resource that does.