Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention…

Question

Options

• ASelf-hosted, Self-Managed
• BSelf-hosted, MSSP Managed
• CHybrid Model, Jointly Managed
• DCloud, Self-Managed

• A
  2% (1)
• B
  6% (3)
• C
  83% (44)
• D
  9% (5)

Explanation

In the scenario described, Robin's organization is capable of handling several critical SIEM functions internally, such as Correlation, Analytics, Reporting, Retention, Alerting, and Visualization. However, they need to outsource the collection and aggregation services to a Managed Security Services Provider (MSSP). This setup indicates a Hybrid Model of SIEM implementation, where both the organization and the MSSP share responsibilities for managing different aspects of the SIEM. The term "Jointly Managed" further clarifies that both parties - the organization and the MSSP - will have active roles in the SIEM's operation, albeit in different capacities. This approach combines the advantages of in-house management with the expertise and resources of an MSSP, offering a balanced solution tailored to the organization's specific capabilities and needs. "Security Information and Event Management (SIEM) Implementation," by David R. Miller, Shon Harris, Allen Harper, Stephen VanDyke, and Chris Blask. "Managed SIEM Services: What's Right for Your Organization?" by SANS Institute.

No community discussion yet for this question.