by Jesper Kråkhede, Sweden
Posted in Business, Security Architecture on Mar 30th, 2023
When companies budget for a SIEM, they usually look at one number: the licence or the price per gigabyte. That is maybe a third of the real cost. Here is how I suggest calculating it. Start with data. Estimate the volume per day for each log source and multiply with the price per gigabyte for […]
Posted in Security Architecture, Security metrics, Technology on Mar 3rd, 2023
I have been asked many times which network logs are worth putting into a SIEM. After many incidents, here is my short list, together with what Microsoft recommends for Sentinel. The useful ones. Logs from the internet edge, especially outbound connections and what was denied. They show command and control traffic and data leaving. DNS […]