Multiple U.S.-based companies in the insurance sector have already been hit over the past week and a half, according to Mandiant.
The post Scattered Spider, fresh off retail sector attack spree, pivots to insurance industry appeared first on CyberScoop.
Output-driven SIEM! Apart from EDR and SOC visibility triad, this is probably my most known “invention” even though I was very clear that I stole this from the Vigilant crew back in 2011.
Anyhow, I asked this question on X the other day:
So, what year is this? Let me see … 2025! Anyhow, get a time machine, we are flying to 2012…. whooosh….
… we landed … no dinosaurs in sight so we didn’t screw the time settings.
Now, WTH is “output-driven SIEM”? Back then, I said that it stands for “deploying your SIEM in such a way that NOTHING comes into your SIEM unless and until you know how it would be utilized and/or presented.” This is not about “don’t collect unless you detect” as some have mis-interpreted it, because you may have some logs for context, or for IR or even … gasp … for compliance. Just not for the sheer heck of it :-)
Gemini Deep Research infographic element (2025)What changed?
Let’s see what is different 13 years later, in 2025.
What to do?
What was the best way to architect “output-driven SIEM” yet still not lose the data you may need later for some purpose? Before and around 2010, it was almost always a two-tier system: a SIEM + central log management (CLM). Here are some of my examples from 2009. Is 2 tier system SIEM+CLM still the best answer?
Naturally, we have way more log storage options in 2025 (Clickhouse anybody), but there is a fundamental truth that remains: if you collect a log and save it, somebody somewhere pays for a hard drive. Nothing has ever charged it, and probably never will.
Look, I like modern one-tier stuff as much as the next person. Google SecOps (formerly Chronicle) can store logs hot for a year (or more!) in a very affordable fashion. But very obviously “one tier for all logs” is not an answer for all SIEM and logging questions (at the very least, because compliance retention requirements drives the quest for ever-cheaper storage, eventually devolving to “write-only log retention”).
Gemini Deep Research infographic element (2025)So, to conclude, my “3AM answer” for how to architect an output-driven SIEM in 2025 is: look at modern one-tier approach (like, well, our SecOps), but if that does not fit, go back to the classics (cheap/broad log management tool or a data lake + a SIEM based on “output-driven” model).
What to expect?
My analysis is usually grounded in reality, some say too grounded (read: not ambitious enough). So let me try to act out one of my impulses here. I think AI agents in SOC have a chance — in the future — to shift us from the “output-driven SIEM” to “outcome-driven SOC.” What I — hypothetically — mean by this is that a human operator defines a strategic security outcome for a SOC, and then agents get to work and decide the collection, detection and response datasets, tooling and practices. And then do the work! Amazing, eh? Well, there is a caveat…
And it is … can we have this IRL? Obviously not today (we are far from it), but ask me again in … 3 years. My time machine does not have a forward button, so I have to “crystal ball it”… otherwise, just “organically” wait for 2028. Humans to decide what to do … and then I want the robots to do it!
Eventually.
Related blogs:
Output-driven SIEM — 13 years later was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Output-driven SIEM — 13 years later appeared first on Security Boulevard.