What SIEM platforms provide real-time threat detection and response capabilities?

Modern SIEMS do not just collect log data. They collect all observable telemetry which starts with logs but also includes network telemetry and flow information, telemetry from cloud API fabrics, endpoint observability, and more.

Note that real-time definition in SIEM varies dramatically, and it sometimes may mean "low number of minutes" or "some number of seconds" rather than real-time in the industrial control sense (probably milliseconds).

Modern SIEM solutions need to be "real-time" enough to avoid a threat to proceed one step further. Depending on the attack, if the detection raises an alert after the next step is already started, that's useless. On the opposite side, if detection requires to be done in just a few seconds but there is no automation strategies behind, that might be useless also.

Note that any automated response (yes, even opening a ticket - have you tried opening 20,000 of them?) carries a risk and needs safety safeguards and additional planning.

Predefined response strategies or templates or notebook, name it the way you want, are interesting to define what are the best practices or guidelines that your organization will have to follow. And this can also be shared with your peers. This level defines conceptual objects (such as EDR profile). Activating a template into an organization should transform each conceptual object into real operational stuff (ie an API endpoint of my EDR vendor). By proceeding this way, the security community can work collectively and each organization can have its responses ready when they select their tactical guideline.

No SIEM can be truly real time as the log extraction from cloud services is not. Most of these SaaS take beteen 5 or 20 minutes to arrive to the SIEM. We've gone backwards on RT. There is nothing fastest than on-premise devices

Using CTI as the first engine of a detection workflow is tremendously efficient but it requires 3 things to be possible and useful: - to have a very reliable dataset, otherwise you will generate a ton of false positives and this is exactly what you do not want - to have a lot of compute, because you have to analyse several gigabytes (or even terabytes) of incoming data that will be normalized and matched in real-time with millions of IOCs - to have graph-based CTI. If an alert is raised on an IOC but I have limited details about it, this is useless. As an analyst, I need to understand the basic path behind an indicator such as IOC -> Threat -> Threat_actor

Machine learning for detection is not new, it has been implemented in many solutions and it can improve the detection rate or limit the false positive rate. GenAI is the new thing and it's more about giving help to the analyst to improve his efficiency on doing his job: - Better abilities to understand the global picture behind an alert - Easier to create rules or launching hunting requests - Faster to respond to a threat with an ondemand generated playbook Combining your dataset in a Retrieval approach with a foundational model can do that pretty well.

This technology relies for success on robust security processes (such as alert triage and rule tuning) and skilled humans to operate them, whether they contain AI technologies or not.

An effective metric for enabling visibility using a SIEM or any other sentry for that matter should be effectiveness of the response. Context enriched detection via effective data engineering can shorten your time to resolution significantly. Equip your SOAR and virtual analysis runbooks to act on this context with right stakeholders and you’re looking at lower security personnel churn that SIEM alerts have been blamed for in the past.

XDR and SIEM compete more and more. Both aims to consolidate different features that were technologies by themselves in the past but now tend to be built-in features (SOAR, CTI, SIRP...) for one single goal: SOC activities. In a moment when all this complexity leads to confusion, why not naming this kind of products as #SOCplatform ?