Security buyers hear a stream of acronyms. Three of the most confused are SIEM, SOC and MDR.
SIEM
Security information and event management is software that collects and correlates logs from many systems and raises alerts.
SOC
A security operations centre is the team, process and tools that monitor alerts and respond. It may be in-house or outsourced.
MDR
Managed detection and response is a service where a provider monitors your endpoints and sometimes other telemetry and helps contain threats.
Choosing
- Small teams with limited analysts often get more value from MDR than from running a SIEM.
- Regulated organizations that need full log retention and reporting usually need a SIEM, with in-house or outsourced analysts.
- Large organizations often combine all three.
Whatever you choose, define who responds at 3 a.m. and what they are allowed to do. Technology without a response plan only produces alerts.