Welcome to the SIEM Maturity Self-Assessment


First name:
Last name:
Email address:
Company:
Job title:
Telephone number (If outside of Canada/U.S., include country code):

How long has your organization been using your security information and event management (SIEM) system? (Select one answer)

We began using our first SIEM in the past 12 months

We replaced our SIEM with a new vendor’s SIEM in the past 12 months

We’ve been using the same SIEM for more than 12 months

We don’t have a SIEM

Don’t know

When did your organization last upgrade its SIEM to increase capacity for data ingestion? (Select one answer)

Since we began using our current SIEM, we have not upgraded it

We upgraded our SIEM in the past 12 months

We upgraded our SIEM in the last 12 to 24 months

It’s been more than 24 months since we upgraded our SIEM

Don’t know

How is your SIEM deployed (Check all that apply)

Our SIEM is deployed on-premises

Our SIEM is deployed in our cloud

Our SIEM is deployed both on-premises and in the cloud

Our SIEM functions are covered by other platforms

We have our own SIEM but have a managed security service provider (MSSP) or professional security company manage it

We have our own SIEM and use a managed detection response (MDR) service for threat detection and log management

Don’t know

Describe the visibility that you have over your network environment. (Check all that apply)

Our SIEM can see all network attached devices (servers, endpoints, IoT, etc.)

Our SIEM can identify new devices as they connect to the network (endpoints, IoT, etc.)

Our SIEM can monitor activities on all network attached devices

Our SIEM has visibility into public clouds (Amazon Web Services (AWS), Azure, etc.)

Our SIEM has visibility into virtual machines (EMC, VMware, etc.).

None/Don’t know

Which flow data and logs does your SIEM index and store? (Check all that apply)

Logs from integrated security platforms (firewalls, vulnerability management systems, etc.).

Common network protocol flow data (syslog, NetFlow, JDBC, SNMP, PowerShell, etc.)

Flow data from cloud environments

Endpoint data

Data from machine-to-machine communications (IoT)

None/Don’t know

Describe your SIEM’s threat prevention capabilities (Check all that apply)

Our SIEM can classify assets based on business criticality

Our SIEM can provisionally classify assets when new devices are discovered

Our SIEM enables native SSL decryption for private servers

Our SIEM can determine whether non-encrypted SSL traffic leaving the network represents an indicator of compromise (IOC)

Our SIEM can scan all new file insertions

Our SIEM natively integrates with Microsoft Active Directory and LDAP-supporting servers

Our SIEM can integrate with Network Access Control (NAC) or Identity and Access Management (IAM) systems

None/Don’t know

To detect and qualify threats, our SIEM supports (Check all that apply)

Comparison of current traffic to known malware signatures

Finding of anomalies that lack known malware signatures

Monitoring endpoints and responding to threats on endpoints

Reputation scoring at the time of ingestion (URLs, source-to-destination IPs, bytes sent/bytes received, HTTP submissions, and hits vs. complexity)

Integration of external threat feed data from open-source STIX or TAXII

Incorporation of data cluster analysis to look for anomalous behavior

Pattern matching and machine learning to uncover IoC traffic patterns

None/Don’t know

Which of the following root-cause analysis can your SIEM perform? (Check all that apply)

Full session replay

Base64 to turn text back into its original binary code

Visibility down to the kernel agent

Contextual threat data as metadata

Application of a common taxonomy for logs, endpoints, cloud and external threat-data

Detection of lateral movement (e.g., credentials escalation or other forms of impersonation)

None/Don’t know

Which of the following analytics techniques can your SIEM perform? (Check all that apply)

An overall risk score describing the asset and threat

Plain English descriptions on threat types (phishing, ransomware)

Advanced data science techniques

Behavioral analytics

A common set of analytics for cloud, endpoint and traditional logs

None/Don’t know

Which productivity capabilities does your SIEM support? (Check all that apply)

Metadata is retained and retrievable in all stages of analysis

All relevant data, groups and priorities are automatically pulled in

Storylines are automatically generated

Training modules are provided to lift Tier 1 analysts’ skills

Analyst steps are automatically recorded for future reuse and in creating playbooks

None/Don’t know

How does your SIEM economize on storage costs without compromising retrieval performance? (Check all that apply)

Captures packet headers with metadata

Affordably stores full packets

Compresses logs during collection

Intelligently determines which application traffic data to store

None/Don’t know

Which of these statements describe your SIEM? (Check all that apply)

Our sensors and physical appliances are capable of processing data at 10 Gbps

Our overall SIEM platform can process at least 20,000 event per second (EPS)

Our SIEM encrypts data at rest and in transit.

None/Don’t know

Which certification and reporting capabilities are present on your SIEM? (Check all that apply)

Attentional benchmarks (EAL 2+ certification, HIPAA/HiTRUST, FISMA, etc.)

Out-of-box rules for vertical markets or compliance (NIST 800.53, PCI-DSS, etc.)

Templates for compliance reports (such as GDPR)

None/Don’t know