SIEM Deployment Architectures

What factors impact the choice of SIEM deployment architecture?

Factors include the number of log sources, amount of data, network topology, and regulatory compliance issues.

Self-Hosted, Self-Managed

The organization manages all aspects of the SIEM, from visualization and alerting to data retention.

Self-Hosted, MSSP Managed

The organization is responsible for data collection, while an MSSP handles the rest of the SIEM functions.

Self-Hosted, Jointly Managed

The organization handles data collection and aggregation, while the MSSP manages correlation, analytics, reporting, and retention.

Cloud, MSSP Managed

The MSSP manages the SIEM, which is hosted in the cloud.

Cloud, Jointly Managed

The organization and the MSSP share responsibility for managing the SIEM, which is hosted in the cloud.

Cloud, Self-Managed

The organization manages all aspects of the SIEM, which is hosted in the cloud.

Hybrid Module, Jointly Managed

The organization and the MSSP share responsibility for managing the SIEM, using a hybrid of on-premises and cloud resources.

Fill in the Blank: In a SIEM deployment architecture, __________ is when the organization manages all aspects, including data retention.

Self-Hosted, Self-Managed.

Fill in the Blank: In __________ deployment, the MSSP manages the SIEM which is hosted in the cloud.

Cloud, MSSP Managed.

Fill in the Blank: With __________, the organization and MSSP share responsibility for a hybrid SIEM solution.

Hybrid Module, Jointly Managed.