Does a small business need a SIEM at all?

Usually not as a first step, unless a customer, an auditor or a regulator explicitly asks for central log retention. A SIEMSIEM: security information and event management. A system that collects logs from many systems and looks for patterns across them. (security information and event management) earns its cost when someone has time to connect sources, write searches and read the results. A small business often gets more protection, sooner, from multi-factor authentication, endpoint protection, offline backups and detection that runs without log engineering. What you should keep in any case are the logs that matter most for an investigation: sign-ins to e-mail and remote access, firewall and VPN logs, and server security logs, stored somewhere an attacker cannot easily delete them and with correct time on every device. Many cloud services keep sign-in logs for you if you switch it on. NetSenX keeps an audit log on every plan and alert history per plan, and if you later add a SIEM, its alerts can be exported there from the Business plan.

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics