A couple weeks ago my wife was watching the Masters and I happened to see Phil Mickelson hit his second eagle in a row. The amazing part to me are all the vectors in play that led the ball to eventually fall into a hole with a 4.25 inch diameter: gravity, ball spin, force upon landing, multiple slopes on the green, etc.
I wondered if there was an analogy between that and ArcSight/SIEM use cases. The problem is I am not sure which side of the analogy they fall on.
On one hand the SIEM content creator could be the golfer and the badness you are trying to capture is the ball. You massage your content so that you see this, followed by that, followed by this other thing and then WHAM the trap springs and you have IDed badness – red flags go up and the alarm gong sounds. In that sense I often think of ArcSight as building a cantilevered mouse trap.
On the other hand the “bad guy” could be both the golfer and the golf ball. The content creator is really just focused on people who hit the green and doesn’t really care about how they got there. If the ball lands in the hole then things are really really bad but the key here is proximity to the hole is enough to alert on/be reviewed.
At a bigger picture level the two ways of looking at the analogy probably represent a SIEM centric vs Log review approach.
Interesting analogy (although I had to look up Eagle...).
ReplyDeleteI see this metaphor as the content author being the golfer, the hole is what you want to achieve, and the golf club is the SIEM. There is no way the golfer can calculate every breeze of wind, and other forces that intervene between the ball and the goal, but a good enough strike in the right direction can get him so much closer to his goal.
- DAK
Thanks for the comment Doron and you are right - your twist to the analogy works. As you are a solutions engineer though I am not surprised you thought in those terms =). Maybe to extend the analogy even further you play the front 9 and the rest of us get the back.
ReplyDelete