SIEM Checklist

 SIEM Prospective
 Interface (Ease of usage)
 Geo-Redundancy
 Product performance
 Segregation of duties
 Handling of Assets, Notification
 Analysing
 Reporting
 Event Collection

 Multi-Source SIEM Security Monitoring, Analysis, Correlation &

Alerting
 Correlation Directives
 Asset Discovery Signatures
 Vulnerability Assessment Signatures
 Dynamic Incident Response Templates alert
 User & Entity Behaviour Analytics (UEBA)

 Asset Management (Discover & Track PCs, Software, and software

Services)
 Vulnerability & Threat Assessment (Current & Historical)
 User Behaviour, User Management & Access Control
 Behavioral Monitoring & Anomaly Detection (OS Services, Net flow,
NW Protocols & Packet Capture)
 Forensics Investigation (Logs, Net flow, Packets, IDS, Vulnerability
Scans, Assets)
 Reporting (Compliance & Custom)
 Active Management