5 Things to Know About Next-Generation SIEM

Cloud-native NG-SIEMs offer significant advantages: Only two of the solutions in the 2021-22 NG-SIEM Omdia Universe met Omdia's definition for being fully cloud native. (As a prerequisite to participate, all had to offer either cloud-native or cloud-hosted versions of their solutions.) But at present, Omdia believes fully cloud-native NG-SIEMs offer distinct advantages. They consistently deliver faster, simpler deployment; they provide superior systems management; faster and often transparent software upgrades; more frequent new features; new detection and parser content are often all handled by the vendor, akin to a managed service; and they can scale dynamically to automatically accommodate an increase in data sources or burst ingestion events. By the end of 2022, Omdia expects these capabilities to be common across NG-SIEM vendors, but until then, solutions that already include these cloud-native capabilities offer operational advantages for customers, and pose competitive challenges for the rest of the market.

Security data science is an emerging differentiator: One of the primary reasons traditional SIEMs never delivered on their potential is that data processing and normalization — a fundamental capability within threat detection that underpins the entire TDIR life cycle — is exceedingly challenging. A discipline emerging within NG-SIEMs to address this is what Omdia defines as security data fusion. This is the process whereby multisource data, typically disparate, is brought together and analyzed using new or alternative methods, not only to approximate the current security posture of an organization within a given scope but also to predict the likelihood that certain events will occur in the future. It may seem like science fiction today, but the most successful NG-SIEM vendors in the long term are likely to be those that invest in developing improvements in security data science, including security data fusion.

Data ingestion-based pricing is finally fading away: Traditionally, SIEM pricing has been based on the amount or volume of data taken in by the SIEM. While this paradigm was advantageous for the vendors, it unintentionally inhibited customers from using a SIEM to its fullest extent. In practice, this has meant that enterprises have often had to exclude important telemetry sources, such as DNS logs or endpoint detection and response (EDR) logs, from the data sources sent to the SIEM because the volume of data was too great, significantly increasing cost. Fortunately, many NG-SIEM providers are evolving their pricing models. Employee-based pricing, typically tiered based on the number of full-time employees in the customer's organization, is increasingly common and allows for more predictable annual or contract-duration costs. Other pricing models, such as term-based flat fee, will soon become standard. Vendors are also increasingly introducing multitiered storage, adding options such as "cold" or infrequently accessed storage, which will come with reduced pricing.

NG-SIEM is distinct from XDR: NG-SIEM finds itself squarely in the crosshairs of another emerging and rapidly advancing enterprise cybersecurity product segment: Extended detection and response (XDR). The definition of XDR remains in flux: Ask 10 vendors how they define XDR, and you will get 10 different answers. But it is clear that many XDR vendors are positioning their solutions as alternatives to NG-SIEMs, delivering integrated TDIR capabilities that are better, faster, and cheaper than NG-SIEMs. Both product segments are early in their life cycles, hence much is yet to be determined, but ultimately both will thrive. Omdia anticipates that XDR will come to be defined as a TDIR solution that focuses on specific threat types and outcomes with efficient, selective use of data. Perhaps most importantly, unlike highly customizable NG-SIEMs, XDR will provide a guided experience, delivering enterprise-grade TDIR capabilities to organizations with less security maturity. Largely for that reason, XDR will often be delivered as a managed service. NG-SIEM will serve as the preferred choice for large enterprises with expansive hybrid cloud environments, dedicated security operations center (SOC) teams, and specific, detailed compliance and reporting demands.

The best NG-SIEMs are laser-focused on outcomes: The overall top-ranked solution in the 2021-22 NG-SIEM Omdia Universe exceled in two key areas where other vendors largely struggled. One is querying and threat hunting: buyers need natural language-based searching to enable SOC analysts and threat hunters alike to easily identify, for example, users and entities whose sessions contain specific activities and/or values, or any combination of activities/attributes by risk score. The other area is event analysis, which Omdia defines as capabilities that help analysts develop unique insights, draw conclusions, and identify follow-on response actions. The most effective solutions offer a chronological incident timeline using manually added and system-gathered data, providing a uniquely fast, easy-to-understand mechanism for SOC analysts to examine an incident, pinpoint causes, and gain insight on the best courses of action for successful remediation. Buyers should look for differentiation in outcome-driven features that enables SOC analysts to do their jobs with greater efficiency and effectiveness.