Classification of Modern Security Information and Event Management Systems
Thearticle suggestsoneoftheoptionsfortheclassificationof Security Informationand Event Managementsystems(SIEM) based on the analysis of the well-established scientific works and systematization of the existing views on the issues of SIEM systemsconstruction. This analysiswascarriedoutbystudyingthescientificandtechnicalliterature, includingcurrent scientific publications, review materials, detailed descriptions of architecture features and security event processing technologies used in SIEM, documentation of commercial solutions and open source projects. Among the variety of characteristics of SIEM solutions the most “salient” classification features are singled out and divided into three groups reflecting the architectural features of security information and event management systems, corresponding to the applied technologies used for processing security events and specifics of their implementation by an end-user. The proposed approach is demonstrated on the example of the classification of modern SIEM solutions of the following categories: foreign production («ArcSight ESM»,«QRadar SIEM»), domestic production («MaxPatrol SIEM», «COMRAD»), open source («OSSIM»). The presented classification allows to systematize the knowledge in the subject area and it can be used in further studies of modern SIEM systems, for the conduct of a comparative analysis and the improvement of existing as well as the development of advanced security information and event management systems.