Welcome back! Previously, we discussed security
frameworks, controls, and design principles, and how security professionals
apply these to security audits. In this section, we’ll continue
to explore security tools and how they can help you keep organizations
and the people they serve safe. Security professionals often use
a variety of tools to address specific security challenges,
such as collecting security data, detecting and analyzing threats, or
automating tasks. Security tools help organizations achieve
a more comprehensive security posture. We’ll begin by covering
different types of logs, what they track, and how they’re used. Then we’ll explore security
information and event management, otherwise known as SIEM, dashboards. Finally, we’ll discuss some common SIEM
tools used in the security industry. Let’s get started!

Tutorial on Logs and SIEM Tools in Cybersecurity

Logs

Logs are records of events that occur within an organization’s systems and networks. They can be used to track a wide variety of information, such as login attempts, network traffic, system changes, and security events.

Types of logs

There are many different types of logs, but some of the most common include:

• Firewall logs: Firewall logs record all attempted or established connections to and from a network.
• Network logs: Network logs record all traffic that flows through a network, including the source and destination IP addresses, the ports used, and the protocols used.
• Server logs: Server logs record events that occur on servers, such as login attempts, file changes, and application errors.
• Security logs: Security logs record security-related events, such as virus detections, failed login attempts, and firewall alerts.

Uses of logs

Logs can be used for a variety of purposes, including:

• Auditing: Logs can be used to audit system activity and identify any unauthorized or suspicious activity.
• Troubleshooting: Logs can be used to troubleshoot problems with systems and networks.
• Security: Logs can be used to detect and investigate security incidents.

SIEM tools

Security information and event management (SIEM) tools are applications that collect and analyze log data from a variety of sources. SIEM tools can be used to:

• Monitor systems and networks for security threats
• Detect and investigate security incidents
• Generate reports on security activity

Benefits of using SIEM tools

SIEM tools can provide a number of benefits to organizations, including:

• Improved visibility into security activity
• Reduced time to detect and respond to security incidents
• Improved compliance with security regulations

How to use SIEM tools

To use a SIEM tool, you will first need to collect log data from the systems and networks that you want to monitor. Once you have collected the log data, you will need to configure the SIEM tool to parse and analyze the data.

Once the SIEM tool is configured, you can begin to monitor your systems and networks for security threats. The SIEM tool will generate alerts when it detects any suspicious activity. You can then investigate the alerts to determine if a security incident has occurred.

Conclusion

Logs and SIEM tools are essential tools for cybersecurity professionals. Logs can be used to track a wide variety of information, including security-related events. SIEM tools can be used to collect and analyze log data from a variety of sources to monitor systems and networks for security threats, detect and investigate security incidents, and generate reports on security activity.

Here are some additional tips for using logs and SIEM tools effectively:

• Collect logs from all relevant sources. This will give you the best possible visibility into your systems and networks.
• Normalize the log data. This will make it easier to analyze the data and identify suspicious activity.
• Use SIEM tools to correlate events from different sources. This will help you to identify patterns and trends that may indicate a security incident.
• Tune the SIEM tool to reduce false positives. False positives can waste time and resources.
• Regularly review the SIEM tool alerts. This will help you to identify and respond to security incidents quickly.

As a security analyst, one of your responsibilities
might include analyzing log data to mitigate and manage threats, risks, and
vulnerabilities. As a reminder, a log is
a record of events that occur within an organization’s
systems and networks. Security analysts
access a variety of logs from different sources. Three common log sources
include firewall logs, network logs, and server logs. Let’s explore each of these
log sources in more detail. A firewall log is a
record of attempted or established connections for incoming traffic
from the internet. It also includes
outbound requests to the internet from
within the network. A network log is a record of all computers and devices that enter and
leave the network. It also records
connections between devices and services
on the network. Finally, a server
log is a record of events related to services
such as websites, emails, or file shares. It includes actions
such as login, password, and username requests. By monitoring logs, like
the one shown here, security teams can identify vulnerabilities and
potential data breaches. Understanding logs is important because SIEM tools rely on logs to monitor systems and
detect security threats. A security information and
event management, or SIEM, tool is an application that collects and
analyzes log data to monitor critical activities
in an organization. It provides real-time
visibility, event monitoring and analysis,
and automated alerts. It also stores all log data
in a centralized location. Because SIEM tools index and
minimize the number of logs a security professional must manually review and analyze, they increase efficiency
and save time. But, SIEM tools must be
configured and customized to meet each organization’s
unique security needs. As new threats and
vulnerabilities emerge, organizations must
continually customize their SIEM tools to ensure that threats are detected
and quickly addressed. Later in the
certificate program, you’ll have a chance
to practice using different SIEM tools to identify potential
security incidents. Coming up, we’ll explore SIEM dashboards and
how cybersecurity professionals use
them to monitor for threats, risks, and
vulnerabilities.

We’ve explored how
SIEM tools are used to collect and analyze log data. However, this is just one of the many ways SIEM tools
are used in cybersecurity. SIEM tools can also be used
to create dashboards. You might have
encountered dashboards in an app on your
phone or other device. They present information
about your account or location in a format
that’s easy to understand. For example, weather apps display
data like temperature, precipitation, wind speed, and the
forecast using charts, graphs, and other
visual elements. This format makes
it easy to quickly identify weather
patterns and trends, so you can stay prepared and
plan your day accordingly. Just like weather
apps help people make quick and informed
decisions based on data, SIEM dashboards help
security analysts quickly and easily access their organization’s
security information as charts, graphs, or tables. For example, a security analyst receives an alert about a
suspicious login attempt. The analyst accesses
their SIEM dashboard to gather information
about this alert. Using the dashboard, the analyst discovers
that there have been 500 login attempts
for Ymara’s account in the span
of five-minutes. They also discover that the
login attempts happened from geographic locations
outside of Ymara’s usual location and outside
of her usual working hours. By using a dashboard, the security analyst was
able to quickly review visual representations
of the timeline of the login attempts, the location, and the exact
time of the activity, then determine that the
activity was suspicious. In addition to providing a comprehensive summary
of security-related data, SIEM dashboards also provide stakeholders with
different metrics. Metrics are key
technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a
software application. SIEM dashboards can be customized to display
specific metrics or other data that are relevant to different members
in an organization. For example, a security
analyst may create a dashboard that displays metrics for monitoring everyday
business operations, like the volume of incoming
and outgoing network traffic. We’ve examined how
security analysts use SIEM dashboards to help organizations maintain
their security posture. Well done! Coming up, we’ll discuss some
common SIEM tools used in the cybersecurity
industry. Meet you there.

Tutorial on SIEM Dashboards in Cybersecurity

What is a SIEM dashboard?

A SIEM dashboard is a visual representation of security data that is collected and analyzed by a SIEM tool. SIEM dashboards can be used to monitor systems and networks for security threats, detect and investigate security incidents, and generate reports on security activity.

Benefits of using SIEM dashboards

SIEM dashboards provide a number of benefits, including:

• Improved visibility into security activity: SIEM dashboards provide a single view of all security-related activity across an organization’s systems and networks. This can help security analysts to quickly identify suspicious activity and respond to security incidents.
• Reduced time to detect and respond to security incidents: SIEM dashboards can help security analysts to quickly detect and respond to security incidents by providing real-time alerts and insights into security activity.
• Improved compliance with security regulations: SIEM dashboards can help organizations to comply with security regulations by providing evidence of security monitoring and incident response.

How to create a SIEM dashboard

To create a SIEM dashboard, you will first need to identify the security data that you want to display on the dashboard. Once you have identified the data, you will need to configure the SIEM tool to generate the dashboard.

Most SIEM tools provide a variety of pre-built dashboards that you can use. However, you can also create custom dashboards to meet your specific needs.

When creating a SIEM dashboard, it is important to consider the following:

• Audience: Who will be using the dashboard? What information do they need to see?
• Purpose: What is the purpose of the dashboard? Is it to monitor for security threats, detect and investigate security incidents, or generate reports on security activity?
• Layout: How should the information on the dashboard be organized?
• Visualization: What types of visualizations should be used to display the data?

Examples of SIEM dashboards

Here are some examples of SIEM dashboards:

• Security posture dashboard: This dashboard provides a high-level overview of the organization’s security posture. It may include metrics such as the number of security events detected, the number of open security incidents, and the number of security vulnerabilities.
• Threat detection dashboard: This dashboard monitors for security threats in real time. It may include alerts for suspicious login attempts, network intrusions, and malware infections.
• Incident response dashboard: This dashboard provides information about open security incidents. It may include details about the incident, the affected systems, and the actions that have been taken to respond to the incident.

Conclusion

SIEM dashboards are a valuable tool for security analysts and organizations of all sizes. SIEM dashboards can help security analysts to quickly identify suspicious activity, detect and investigate security incidents, and generate reports on security activity.

Here are some additional tips for creating effective SIEM dashboards:

• Use clear and concise labels. The labels on your dashboard should be clear and concise so that users can easily understand what the data represents.
• Use appropriate visualizations. The type of visualization you use should be appropriate for the data you are displaying. For example, line charts are good for displaying trends over time, while bar charts are good for displaying comparisons between different categories.
• Use color sparingly. Too much color on a dashboard can be overwhelming and make it difficult to read the data. Use color to highlight important information or to draw attention to areas of concern.
• Keep your dashboard up to date. SIEM dashboards should be updated regularly to reflect the latest security data.

By following these tips, you can create SIEM dashboards that will help you to improve your organization’s security posture.

[MUSIC] My name is Parisa and I’m a vice president
of engineering and lead the Chrome Team. So as General manager of the Chrome Team,
I lead a team of engineers and product managers and
designers around the world who actually build Chrome and
keep all of our users safe. I think accessibility is important
to all aspects of technology, and when we think about its relevance for cybersecurity, you know, we ultimately
want to keep everybody safe. I think of accessibility as making
information, activities, or even environments meaningful, sensible,
usable to as many people as possible. And when we’re talking about this in
a technology standpoint, it’s usually about making information or services
available to people with disabilities. Decisions we make based on our own
abilities to enhance security can actually be ineffective. For example, you’ll sometimes
see the color red used for indication of a warning. Well, for somebody who’s colorblind, like
that is going to be ineffective. And so really thinking about accessibility
when we’re trying to keep people safe is super important for them to be effective. I’ve worked in the space of security for
a really long time. And I do see some parallels
between the spaces. I’ve really been able to see innovation
driven when you’re trying to solve a very specific security problem or
a specific accessibility problem. Closed Captioning was originally
designed and built to help people with hearing impairments, but
it ends up helping everybody. For people who are new to the field of
cybersecurity, it’s just really important to remember that there’s a range of
abilities that you are wanting to serve. It’s so important to get user research and
feedback and a range of abilities in terms of testing the effectiveness
of your security mitigations. I know it was scary for me early on. I didn’t look like everybody else. I really struggled with
whether I belonged. Finding people who could be mentors,
having the courage to ask questions and recognize that you’re rarely
the only person with that question. And just sort of persevering through,
sometimes hard moments can lead to breakthroughs and
also just growing confidence. And one of the things I’ve
learned is me having a different background than other people in
this space was my own superpower. Instead of focusing on the delta between
what I was and what the norm was in the room, I should feel a lot of
pride in what made me unique and what unique skills and
perspective I brought to the table.

To explore common SIEM tools, you can:

1. Visit the websites of SIEM vendors. This is a good way to learn about the features and capabilities of each tool, as well as their pricing and deployment options.
2. Read reviews of SIEM tools. This can be helpful for getting an unbiased opinion of each tool from other users.
3. Attend webinars and conferences where SIEM tools are discussed. This is a great way to learn more about SIEM tools from experts and ask questions.
4. Try out SIEM tools in a sandbox environment. Many vendors offer sandbox environments where you can try out their SIEM tools before you buy them.

Here are some of the most common SIEM tools:

• Splunk Enterprise is a self-hosted SIEM tool that is known for its scalability and performance. It is a popular choice for large enterprises with complex security needs.
• Splunk Cloud is a cloud-hosted SIEM tool that is easy to deploy and manage. It is a good choice for organizations that do not want to invest in their own infrastructure.
• Chronicle is a cloud-native SIEM tool that is designed to take advantage of the scalability and flexibility of cloud computing. It is a good choice for organizations that are running hybrid or cloud-only environments.
• SolarWinds Security Event Manager is a self-hosted SIEM tool that is known for its affordability and ease of use. It is a good choice for small and medium-sized businesses.
• LogRhythm Security Intelligence Platform is a self-hosted SIEM tool that is known for its comprehensive security features and analytics capabilities. It is a good choice for large enterprises with complex security needs.

Once you have explored a few different SIEM tools, you can start to narrow down your choices based on your specific needs and budget. Be sure to consider the following factors when choosing a SIEM tool:

• Deployment options: Do you want a self-hosted, cloud-hosted, or hybrid SIEM tool?
• Scalability: How much data do you need to process? How many users will be using the SIEM tool?
• Features: What features are important to you? For example, do you need a SIEM tool with threat intelligence capabilities, or one that can integrate with other security tools?
• Pricing: How much are you willing to spend on a SIEM tool?

Once you have chosen a SIEM tool, you can start to deploy and implement it. Be sure to follow the vendor’s instructions carefully to ensure a successful deployment.

Here are some additional tips for exploring common SIEM tools:

• Start by identifying your specific needs. What are the biggest security threats facing your organization? What kind of data do you need to collect and analyze?
• Do your research. Read reviews, compare features, and get quotes from different vendors.
• Try out different SIEM tools in a sandbox environment. This will give you a chance to see how each tool works and decide which one is right for you.
• Consider your budget. SIEM tools can be expensive, so make sure to factor in the cost of the tool, as well as the cost of deployment and maintenance.
• Get help from a consultant. If you are not sure which SIEM tool is right for you, or if you need help deploying and implementing the tool, consider working with a consultant.

Hello again! Previously, we discussed how SIEM tools
help security analysts monitor systems and detect security threats. In this video, we’ll cover some
industry leading SIEM tools that you’ll likely encounter as a security analyst. First, let’s discuss the different
types of SIEM tools that organizations can choose from, based
on their unique security needs. Self-hosted SIEM tools require
organizations to install, operate, and maintain the tool using their own physical
infrastructure, such as server capacity. These applications are then managed and
maintained by the organization’s IT department,
rather than a third party vendor. Self-hosted SIEM tools are ideal
when an organization is required to maintain physical
control over confidential data. Alternatively, cloud-hosted
SIEM tools are maintained and managed by the SIEM providers, making
them accessible through the internet. Cloud-hosted SIEM tools are ideal for
organizations that don’t want to invest in creating and
maintaining their own infrastructure. Or, an organization can choose to use
a combination of both self-hosted and cloud-hosted SIEM tools,
known as a hybrid solution. Organizations might choose a hybrid SIEM
solution to leverage the benefits of the cloud while also maintaining
physical control over confidential data. Splunk Enterprise, Splunk Cloud,
and Chronicle are common SIEM tools that many organizations use
to help protect their data and systems. Let’s begin by discussing Splunk. Splunk is a data analysis platform and
Splunk Enterprise provides SIEM solutions. Splunk Enterprise is a self-hosted tool
used to retain, analyze, and search an organization’s log data to provide security
information and alerts in real-time. Splunk Cloud is a cloud-hosted tool used
to collect, search, and monitor log data. Splunk Cloud is helpful for organizations
running hybrid or cloud-only environments, where some or all of the organization’s
services are in the cloud. Finally, there’s Google’s Chronicle. Chronicle is a cloud-native tool designed
to retain, analyze, and search data. Chronicle provides log monitoring,
data analysis, and data collection. Like cloud-hosted tools, cloud-native tools are also fully
maintained and managed by the vendor. But cloud-native tools
are specifically designed to take full advantage of cloud computing
capabilities such as availability, flexibility, and scalability. Because threat actors are frequently
improving their strategies to compromise the confidentiality,
integrity, and availability of their targets,
it’s important for organizations to use a variety of security
tools to help defend against attacks. The SIEM tools we just discussed are only
a few examples of the tools available for security teams to use to help
defend their organizations. And later in the certificate program, you’ll have the exciting opportunity to
practice using Splunk Cloud and Chronicle.

I’m Talia, and I’m an
engineer within privacy, safety and security at Google. So there are a lot of myths in
the cybersecurity space. One big one is, you must know how to code, or you must know how to hack, or you must be a math wiz. I don’t know how to code, although I have learned how
to read code over time. I’m not a hacker. I’m not on the red
team site of security, I’m more on like the blue team. I’m not a math wiz. I definitely took
the business route, but I’m not a mathematician. That wasn’t really the path. A lot of my strength really lies in my ability to
build relationships, learn quickly on the job, doing, conducting research, asking
all the right questions. I think those have been
my strongest strength. Another big myth, is that, you are required to have
a cybersecurity degree. I actually went to
school for business, an advanced degree
is not required. Even though I did
later on go back, That was my preference. You do not need to
pursue that in order for you to be considered a great
candidate for cybersecurity. Another big one is you work in isolation within
cybersecurity. It really depends on the
path that you choose. But I found that to
be one of the most that couldn’t be further
from the truth. My biggest advice for anyone who’s interested in
cybersecurity is, be okay with creating
your own path. The path looks
different for everyone. If you were to talk to
five different people, their journeys are
all different. So own your journey, and identify people
who can support you. Let them know that you’re
sitting for the certificate, and see what support
that you can get as you start your journey.

Let’s quickly review what we covered
in this section of the course. We started by discussing the importance
of logs and cybersecurity, and we explored different log types,
like firewall, network, and server logs. Next, we explored SIEM dashboards and how they use visual representations to
provide security teams with quick and clear insights into the security
posture of an organization. Finally, we introduced common SIEM
tools used in the cybersecurity industry, including Splunk and Chronicle. We’ll be exploring even more security
tools later in the program, and you’ll have opportunities
to practice using them. Coming up, we’ll discuss playbooks and
how they help security professionals respond appropriately to identify threats,
risks, and vulnerabilities. Meet you there.