Effective InfoSec Monitoring implementation: Top 3 key considerations
By: Harun Polat
Tags: Security Monitoring, Information Security, Mitre Attack, Siem, Cybersecurity

A company’s capability of detecting cyber-attacks is vital for the maintenance of its resilient security posture and is often done with a Security information and event management (SIEM) system.

To help you kickstart a successful technical information security monitoring implementation I have compiled a list with the top 3 considerations for a successful SIEM implementation.

1. Identify critical information assets!

One of the most important aspects of cyberattack detection is having a clear view of the company’s critical information assets (crown jewels). Since a company cannot (and therefore should not) monitor every piece of information the focus needs to be on those with the biggest potential damage in case of an unauthorized information exfiltration.

In order to identify the crown jewels, the textbook/proven method of relevant stakeholder identification and workshop conduction is highly recommended. In these workshops, the departments provide insights into the business and the management reports on strategic plans.

Insights into the business by the specialist departments can, for example, reveal intellectual property that is particularly worth protecting. In the case of an automotive group, this could be design plans for new car engines or in the financial sector sensitive information such as non-performing loans.

Updates from the Management can provide insights into strategic projects, such as the development of new markets (e.g. e-mobility in the automotive industry) or digitalization plans which can reveal future crown jewels.

Since conducting such workshops is time-consuming and involve high organizational effort, past (relevant) audit reports/findings, as well as a former business impact analysis, should be reviewed in the meantime.



These provide good indications about the company’s critical information assets which should be the focus of every cyberattack detection effort.

2. Select and prioritize information assets for SIEM Onboarding wisely!

An unstructured and badly planned SIEM log source onboarding is disadvantageous from a security perspective as well as a business point of view.

The reason for that is simple:

From a business point of view, this results in higher engineering costs (e.g. due to potentially needed diverse log source connectors) and increased operational SIEM platform costs (e.g. due to increased log information processing power). From a security perspective, the number of incoming logs reduces the analyst’s ability to detect attacks. The attacker’s actions become the famous needle in the haystack.

SIEM log source example: Differentiate between the kind of use case and type of use case

When it comes to selecting appropriate log sources it should be differentiated between the following two kinds of log sources:

Critical information containing

Context providing.

The former contains the crown jewels to be protected (e.g. non-performing loans in banking). The latter provides context information needed for implementing security-related scenarios (SIEM use cases) to be monitored (e.g. proxy for unauthorized data exfiltration detection).

Furthermore, the different kind of log sources should be differentiated at least between the following two types of log sources

Operating System Level

Application Level.

This simply means that if, for example, proxy logs (context providing application-level log source) are to be used to detect unauthorized data exfiltration, the operating system logs of the machine running the proxy server must also be taken into account.

3. Select and organize scenarios to be monitored (SIEM use cases) properly!

A SIEM’s capability to detect security-related scenarios is one of the most important technical aspects of a successful information security monitoring implementation.

Therefore a systematical SIEM use case approach including use case selection, organization and technical description as provided below should be considered.

Pragmatic SIEM use case approach: Three fundamental steps

Use Case Selection

The Cyber Kill Chain is a great starting point for threat-centric use case selection. It dissects a cyber attack into its essential stages which is a great orientation when it comes to selecting appropriate SIEM use cases.

As it generalizes cyber-attacks, technical, domain, and organization-specific adaptations are highly recommended.

ATT&CK Framework: Adversarial Tactics, Techniques, and Common Knowledge framework

But no worries, there is no reason to reinvent the wheel. The MITRE ATT&CK Framework provides cyber kill chain adaptations and extensions such as concrete techniques e.g. for the final cyber kill chain stage “Actions on Objectives”.

Use Case Organization

Talking about threats often includes descriptions at different abstraction layers. The CISO will e.g. talk about general data leakage risks for the business whereas the SOC Manager will talk about the detection of “suspicious mass devices usage” and the SOC Engineer will focus on lower-level aspects like “successful USB storage mount” detection. Those abstraction levels are all important and need to be combined.

The MaGMa Framework combines all of these different abstraction layers.

MaGMa Framework: Proposed use case abstraction layers

It is not only a great starting point for organizing the different abstraction levels of cybersecurity threat descriptions but also already includes technical use cases based on the MITRE ATT&CK Enterprise Matrix.

Technical use case description

An actual technical use case implementation is SIEM vendor-specific and therefore results in increased reimplementation efforts and costs in case of a vendor change.

Wouldn’t it be great if SIEM use cases could be described in a generic format and automatically translated into different vendor formats?

This is where Sigma Rules come into play!

Overview Sigma rules workflow: From generic description to vendor-specific use case implementation

Again: Do not reinvent the wheel. Just take a sigma rule shared by the community (for instance from this Repository) and translate them as needed on https://uncoder.io/.