1. 5. Integration and Testing
1.1. a.
1.2. b.
1.3. c.
1.4. d.
1.5. e.
1.6. f.
1.7. g.
1.8. h.
1.9. i.
1.10. j.
2. 6. Acceptance, Deployment
2.1. a.
2.2. b.
2.3. c.
2.4. d.
2.5. e.
2.6. f.
2.7. g.
3. 7. Maintenance
3.1. a.
3.2. b.
3.3. c.
3.4. d.
3.5. e.
3.6. f.
3.7. g.
3.8. h.
3.9. i.
3.10. j.
3.11. k.
3.12. l.
4. 1. Project Planning
4.1. A. Determine the need for SIEM Solution
4.1.1. 1. What problem are we solving with this solution
4.1.1.1. a. log retention b. regulatory compliance c. security management d. tying together alerts from disparate ss e. consolidation of manpower, etc.
4.1.2. 2. What Products are you going to be taking log data from?
4.1.2.1. 1. Ensure 2. Plan 3. Look for 4. Learn the data 5. Involve data-owners
4.1.3. 3. What AOB are you going to take data from?
4.1.3.1. Plan for some excess capacity or the ability to add capacity easily, you can expect to gain additional customers you have not planned for in the initial design.
4.1.4. 4. What AOB are you going to offer services (& which services) to?
4.1.4.1. 1. Plan for some excess capacity or the ability to add capacity easily, you expect to gain additional customers you have not planned for in the initial design. 2. Ensure that the product allows for easy, granular and secure access controls so that access can be provided to only the appropriate level of data.
4.2. B. Determine the FV of a SIEM Solution
4.2.1. 1. Software or Appliance costs
4.2.2. 2. Hardware costs
4.2.3. 3. Bandwidth costs
4.2.4. 4. Customization costs
4.2.5. 5. Maintenance costs
4.2.6. 6. Staffing costs
4.3. C. Enterprise Asset Inventory
4.4. D. Enterprise Identity Management Solution
4.5. E. Obtain most accurate mapping
4.6. F. Standardize Systems on a single time zone
4.7. G. NTP
4.8. H. Ensure the data you want to collect is actually being logged by the devices
4.9. I. Evaluate SIEM Products
5. 2. Systems Analysis
5.1. a. Determine the volume of log data (from all sources) you need to be able to accommodate.
5.1.1. i. Decide what to log at what level of granularity
5.1.2. ii. Determine which log messages from each log source will be collected by a SIEM solution
5.1.3. iii. Base numbers on maximum projected log volumes