EP184 One Week SIEM Migration: Fact or Fiction?

Cloud Security Podcast by Google

Content provided by Anton Chuvakin. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Anton Chuvakin or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

3M ago 24:45

MP3•Episode home

Fetch error

Hmmm there seems to be a problem fetching this series right now. Last successful fetch was on November 11, 2024 16:02 (6d ago)

What now? This series will be checked again in the next day. If you believe it should be working, please verify the publisher's feed link below is valid and includes actual episode links. You can contact support to request the feed be immediately fetched.

Guest:

Manan Doshi, Senior Security Engineer @ Etsy

Questions:

In your experience, what are the biggest challenges organizations face when migrating to a new SIEM platform? How did you solve them?
Many SIEM projects have problems, but a decent chunk of these problems are not about the tool being broken. How did you decide to migrate? When is it time to go?
Specifically, how to avoid constant change from product to product, each time blaming the tool for what are essentially process failures?
How did you handle detection content during migration? Was AI involved?
How did you test for this: “Which platform will best enable our engineering team to build what we need?”
Tell us more about the Detection as Code pipeline you use?
“Completed SIEM migration in a single week!” Is this for real?

Resources:

Google Cloud Security Summit (August 20, 2024) and “Etsy and the art of SIEM Migration” presentation
“Ancillary Justice” book
StreamAlert
SIEM migration blog (spicy version / vanilla version / long detailed version)
Can We Have “Detection as Code”?
Google SecOps
EP117 Can a Small Team Adopt an Engineering-Centric Approach to Cybersecurity?

199 episodes

#Tech #Anton Chuvakin #Cloudsecurity #Cybersecurity #Security #Cloud IT