You are right! SIEMs do take some time to implement, especially if you have a lot of sources to monitor and integrate to the SIEM. Give the SIEM a few weeks to set a baseline and clean out false-positive events
Before purchasing a SIEM you have to consider how it should be…
The answer is: all of the above
From a technical point, if you have a lot of sources that generate security alerts/events, you will need a SIEM to help you manage these alerts (collect, analyze, correlate, etc) and determine how you can respond to them appropriately.…
To be honest, SIEMs are difficult to evaluate and it will eat up a lot of time and resources during the trial period. There are also different types of offerings that you can consider like cloud-based or appliance-based SIEMs, which may be a good way to filter the SIEM…
