www.connectwise.com Open in urlscan Pro
2606:4700:4400::ac40:9a78  Public Scan

Form analysis
2 forms found in the DOM

<form class="mktoForm mktoHasWidth mktoLayoutLeft" data-form-id="1301" data-poi="" data-page-source="" data-campaign-code="" data-gclid="" data-zoom-info="" __bizdiag="645404088" __biza="WJ__" id="mktoForm_1301" novalidate="novalidate"
  style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;">
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 10px;">
      <div class="mktoFieldWrap mktoRequiredField"><input id="Email" name="Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email" class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true"
          style="width: 150px;" placeholder="Business Email Address"></div>
    </div>
  </div>
  <div class="mktoFormRow mktoFormRowHidden">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 10px;">
      <div class="mktoFieldWrap mktoRequiredField"><select id="Country" name="Country" aria-labelledby="LblCountry InstructCountry" class="mktoField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;">
          <option value="">Country</option>
          <option value="AF">Afghanistan</option>
          <option value="AL">Albania</option>
          <option value="DZ">Algeria</option>
          <option value="AX">Aland Islands</option>
          <option value="AS">American Samoa</option>
          <option value="AI">Anguilla</option>
          <option value="AD">Andorra</option>
          <option value="AO">Angola</option>
          <option value="AN">Antilles - Netherlands</option>
          <option value="AG">Antigua and Barbuda</option>
          <option value="AQ">Antarctica</option>
          <option value="AR">Argentina</option>
          <option value="AM">Armenia</option>
          <option value="AU">Australia</option>
          <option value="AT">Austria</option>
          <option value="AW">Aruba</option>
          <option value="AZ">Azerbaijan</option>
          <option value="BA">Bosnia and Herzegovina</option>
          <option value="BB">Barbados</option>
          <option value="BD">Bangladesh</option>
          <option value="BE">Belgium</option>
          <option value="BF">Burkina Faso</option>
          <option value="BG">Bulgaria</option>
          <option value="BH">Bahrain</option>
          <option value="BI">Burundi</option>
          <option value="BJ">Benin</option>
          <option value="BM">Bermuda</option>
          <option value="BN">Brunei Darussalam</option>
          <option value="BO">Bolivia</option>
          <option value="BR">Brazil</option>
          <option value="BS">Bahamas</option>
          <option value="BT">Bhutan</option>
          <option value="BV">Bouvet Island</option>
          <option value="BW">Botswana</option>
          <option value="BV">Belarus</option>
          <option value="BZ">Belize</option>
          <option value="KH">Cambodia</option>
          <option value="CM">Cameroon</option>
          <option value="CA">Canada</option>
          <option value="CV">Cape Verde</option>
          <option value="CF">Central African Republic</option>
          <option value="TD">Chad</option>
          <option value="CL">Chile</option>
          <option value="CN">China</option>
          <option value="CX">Christmas Island</option>
          <option value="CC">Cocos Islands</option>
          <option value="CO">Colombia</option>
          <option value="CG">Congo</option>
          <option value="CI">Ivory Coast</option>
          <option value="CK">Cook Islands</option>
          <option value="CR">Costa Rica</option>
          <option value="HR">Croatia</option>
          <option value="CY">Cyprus</option>
          <option value="CZ">Czech Republic</option>
          <option value="CD">Democratic Republic of the Congo</option>
          <option value="DJ">Djibouti</option>
          <option value="DK">Denmark</option>
          <option value="DM">Dominica</option>
          <option value="DO">Dominican Republic</option>
          <option value="EC">Ecuador</option>
          <option value="EG">Egypt</option>
          <option value="SV">El Salvador</option>
          <option value="TP">East Timor</option>
          <option value="EE">Estonia</option>
          <option value="GQ">Equatorial Guinea</option>
          <option value="ER">Eritrea</option>
          <option value="ET">Ethiopia</option>
          <option value="FI">Finland</option>
          <option value="FJ">Fiji</option>
          <option value="FK">Falkland Islands</option>
          <option value="FM">Federated States of Micronesia</option>
          <option value="FO">Faroe Islands</option>
          <option value="FR">France</option>
          <option value="GF">French Guiana</option>
          <option value="PF">French Polynesia</option>
          <option value="GA">Gabon</option>
          <option value="GM">Gambia</option>
          <option value="DE">Germany</option>
          <option value="GH">Ghana</option>
          <option value="GI">Gibraltar</option>
          <option value="GB">Great Britain</option>
          <option value="GD">Grenada</option>
          <option value="GE">Georgia</option>
          <option value="GR">Greece</option>
          <option value="GL">Greenland</option>
          <option value="GN">Guinea</option>
          <option value="GP">Guadeloupe</option>
          <option value="GS">S. Georgia and S. Sandwich Islands</option>
          <option value="GT">Guatemala</option>
          <option value="GU">Guam</option>
          <option value="GW">Guinea-Bissau</option>
          <option value="GY">Guyana</option>
          <option value="HK">Hong Kong</option>
          <option value="HM">Heard Island and McDonald Islands</option>
          <option value="HN">Honduras</option>
          <option value="HT">Haiti</option>
          <option value="HU">Hungary</option>
          <option value="ID">Indonesia</option>
          <option value="IE">Ireland</option>
          <option value="IL">Israel</option>
          <option value="IN">India</option>
          <option value="IO">British Indian Ocean Territory</option>
          <option value="IQ">Iraq</option>
          <option value="IT">Italy</option>
          <option value="JM">Jamaica</option>
          <option value="JO">Jordan</option>
          <option value="JP">Japan</option>
          <option value="KE">Kenya</option>
          <option value="KG">Kyrgyzstan</option>
          <option value="KI">Kiribati</option>
          <option value="KM">Comoros</option>
          <option value="KN">Saint Kitts and Nevis</option>
          <option value="KR">Korea South</option>
          <option value="KW">Kuwait</option>
          <option value="KY">Cayman Islands</option>
          <option value="KZ">Kazakhstan</option>
          <option value="LA">Laos</option>
          <option value="LB">Lebanon</option>
          <option value="LC">Saint Lucia</option>
          <option value="LI">Liechtenstein</option>
          <option value="LK">Sri Lanka</option>
          <option value="LR">Liberia</option>
          <option value="LS">Lesotho</option>
          <option value="LT">Lithuania</option>
          <option value="LU">Luxembourg</option>
          <option value="LV">Latvia</option>
          <option value="LY">Libya</option>
          <option value="MK">Macedonia</option>
          <option value="MO">Macao</option>
          <option value="MG">Madagascar</option>
          <option value="MY">Malaysia</option>
          <option value="ML">Mali</option>
          <option value="MW">Malawi</option>
          <option value="MR">Mauritania</option>
          <option value="MH">Marshall Islands</option>
          <option value="MQ">Martinique</option>
          <option value="MU">Mauritius</option>
          <option value="YT">Mayotte</option>
          <option value="MT">Malta</option>
          <option value="MX">Mexico</option>
          <option value="MA">Morocco</option>
          <option value="MC">Monaco</option>
          <option value="MD">Moldova</option>
          <option value="MN">Mongolia</option>
          <option value="MM">Myanmar</option>
          <option value="MP">Northern Mariana Islands</option>
          <option value="MS">Montserrat</option>
          <option value="MV">Maldives</option>
          <option value="MZ">Mozambique</option>
          <option value="NA">Namibia</option>
          <option value="NC">New Caledonia</option>
          <option value="NE">Niger</option>
          <option value="NF">Norfolk Island</option>
          <option value="NG">Nigeria</option>
          <option value="NI">Nicaragua</option>
          <option value="NL">Netherlands</option>
          <option value="NO">Norway</option>
          <option value="NP">Nepal</option>
          <option value="NR">Nauru</option>
          <option value="NU">Niue</option>
          <option value="NZ">New Zealand</option>
          <option value="OM">Oman</option>
          <option value="PA">Panama</option>
          <option value="PE">Peru</option>
          <option value="PG">Papua New Guinea</option>
          <option value="PH">Philippines</option>
          <option value="PK">Pakistan</option>
          <option value="PL">Poland</option>
          <option value="PM">Saint Pierre and Miquelon</option>
          <option value="CS">Serbia and Montenegro</option>
          <option value="PN">Pitcairn</option>
          <option value="PR">Puerto Rico</option>
          <option value="PS">Palestinian Territory</option>
          <option value="PT">Portugal</option>
          <option value="PW">Palau</option>
          <option value="PY">Paraguay</option>
          <option value="QA">Qatar</option>
          <option value="RE">Reunion</option>
          <option value="RO">Romania</option>
          <option value="RU">Russian Federation</option>
          <option value="RW">Rwanda</option>
          <option value="SA">Saudi Arabia</option>
          <option value="WS">Samoa</option>
          <option value="SH">Saint Helena</option>
          <option value="VC">Saint Vincent and the Grenadines</option>
          <option value="SM">San Marino</option>
          <option value="ST">Sao Tome and Principe</option>
          <option value="SN">Senegal</option>
          <option value="SC">Seychelles</option>
          <option value="SL">Sierra Leone</option>
          <option value="SG">Singapore</option>
          <option value="SK">Slovakia</option>
          <option value="SI">Slovenia</option>
          <option value="SB">Solomon Islands</option>
          <option value="SO">Somalia</option>
          <option value="ZA">South Africa</option>
          <option value="ES">Spain</option>
          <option value="SD">Sudan</option>
          <option value="SR">Suriname</option>
          <option value="SJ">Svalbard and Jan Mayen</option>
          <option value="SE">Sweden</option>
          <option value="CH">Switzerland</option>
          <option value="SZ">Swaziland</option>
          <option value="TW">Taiwan</option>
          <option value="TZ">Tanzania</option>
          <option value="TJ">Tajikistan</option>
          <option value="TH">Thailand</option>
          <option value="TL">Timor-Leste</option>
          <option value="TG">Togo</option>
          <option value="TK">Tokelau</option>
          <option value="TO">Tonga</option>
          <option value="TT">Trinidad and Tobago</option>
          <option value="TN">Tunisia</option>
          <option value="TR">Turkey</option>
          <option value="TM">Turkmenistan</option>
          <option value="TC">Turks and Caicos Islands</option>
          <option value="TV">Tuvalu</option>
          <option value="UA">Ukraine</option>
          <option value="UG">Uganda</option>
          <option value="AE">United Arab Emirates</option>
          <option value="UK">United Kingdom</option>
          <option value="US">United States</option>
          <option value="UM">United States Minor Outlying Islands</option>
          <option value="UY">Uruguay</option>
          <option value="UZ">Uzbekistan</option>
          <option value="VU">Vanuatu</option>
          <option value="VA">Vatican City State</option>
          <option value="VE">Venezuela</option>
          <option value="VG">Virgin Islands</option>
          <option value="VI">Virgin Islands</option>
          <option value="VN">Viet Nam</option>
          <option value="WF">Wallis and Futuna</option>
          <option value="EH">Western Sahara</option>
          <option value="YE">Yemen</option>
          <option value="ZM">Zambia</option>
          <option value="ZW">Zimbabwe</option>
        </select></div>
    </div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoSimple" style="margin-left: 120px;"><button type="submit" class="mktoButton">Submit</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="1301"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="417-HWY-826">
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="Jigsaw" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="mKTOProductInterest" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="pageSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="campaignCodeMostRecent" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="utmcampaign" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="utmcontent" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="utmmedium" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="utmsource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="utmterm" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="referringURL" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="CWS_GCLID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
  <div class="mktoFormRow mktoFormRowHidden"><input type="hidden" name="ga_cid__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 10px;"></div>
</form>

<form class="mktoForm mktoHasWidth mktoLayoutLeft" data-form-id="1301" data-poi="" data-page-source="" data-campaign-code="" data-gclid="" data-zoom-info="" __bizdiag="645404088" __biza="WJ__" novalidate="novalidate"
  style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

___


Trust Center

Contact Us

Sign In


Close Search Modal
Close Search Bar Search
 * Products & Services
 * Community & Resources
 * Why ConnectWise
 * Support

Close Search Modal
Close Search Bar Search
Try For Free


PRODUCTS & SERVICES

 * Business Management
   
   Integrated front and back office solutions

 * Unified Monitoring and Management
   
   Manage customer endpoints and data

 * Cybersecurity and Data Protection
   
   Protect your clients’ critical business assets

 * Asio—The MSP Platform
   
   The purpose-built platform for MSPs

   Explore Solution Marketplace
   
   Third-party integrations to enhance our products


BUSINESS MANAGEMENT

INTEGRATED FRONT AND BACK OFFICE SOLUTIONS

Explore Business Management
PSA
Professional services automation designed to run your as-a-service business
CPQ
Advanced quote and proposal automation to streamline your quoting
BrightGauge
KPI dashboards and reporting for real-time business insights
ITBoost
Centralized, intuitive IT documentation
Service Leadership
Increase shareholder value and profitability
SmileBack
Customer service feedback for MSPs
Business Management Packages
Optimize your business operations through curated packages designed to
streamline, standardize, and automate your business processes
Explore Business Management
PSA
Professional services automation designed to run your as-a-service business
CPQ
Advanced quote and proposal automation to streamline your quoting
BrightGauge
KPI dashboards and reporting for real-time business insights
ITBoost
Centralized, intuitive IT documentation
Service Leadership
Increase shareholder value and profitability
SmileBack
Customer service feedback for MSPs
Business Management Packages
Optimize your business operations through curated packages designed to
streamline, standardize, and automate your business processes
Explore Business Management


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




UNIFIED MONITORING AND MANAGEMENT

MANAGE CUSTOMER ENDPOINTS AND DATA

Explore Unified Monitoring and Management
RMM

Monitor and manage your client's networks the way you want - hands on, automated
or both with our NOC services
Automate

Powerful RMM for next-level IT support
ScreenConnect™

Remotely access and support any device, anywhere, any time
Explore Unified Monitoring and Management
RMM

Monitor and manage your client's networks the way you want - hands on, automated
or both with our NOC services
Automate

Powerful RMM for next-level IT support
ScreenConnect™

Remotely access and support any device, anywhere, any time
Explore Unified Monitoring and Management


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




CYBERSECURITY AND DATA PROTECTION

PROTECT YOUR CLIENTS’ CRITICAL BUSINESS ASSETS

Explore Cybersecurity
MDR
Monitor & stop malicious activity on endpoints
SIEM
Centralize threat visibility and analysis
Risk and Vulnerability Management
Identify cybersecurity risks and routinely scan for vulnerabilities
Access Management

Eliminate shared admin passwords and protect customers
SASE
Apply zero trust secure access for users, locations, and devices
Explore Cybersecurity
MDR
Monitor & stop malicious activity on endpoints
SIEM
Centralize threat visibility and analysis
Risk and Vulnerability Management
Identify cybersecurity risks and routinely scan for vulnerabilities
Access Management

Eliminate shared admin passwords and protect customers
SASE
Apply zero trust secure access for users, locations, and devices
Explore Data Protection
SaaS Backup
Safeguard customer cloud app data
Co-Managed Backup
Streamline third-party backup management
Incident Response Services
Quickly access cybersecurity experts for critical security incidents
Explore Data Protection
SaaS Backup
Safeguard customer cloud app data
Co-Managed Backup
Streamline third-party backup management
Incident Response Services
Quickly access cybersecurity experts for critical security incidents
Explore Cybersecurity and Data Protection


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




ASIO—THE MSP PLATFORM

THE PURPOSE-BUILT PLATFORM FOR MSPS

Explore Platform
Asio

The purpose-built platform for MSPs
Explore Platform
Asio

The purpose-built platform for MSPs
Hyperautomation Solutions
RPA

Eliminate manual steps with easy to use workflows
Sidekick

Generative AI for team productivity
Hyperautomation Solutions
RPA

Eliminate manual steps with easy to use workflows
Sidekick

Generative AI for team productivity

See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




COMMUNITY & RESOURCES

 * Community
   
   Peer groups, user groups, industry connections

 * Events
   
   Global industry conferences and experiences

 * Resources
   
   Business-driving insights and guidance


COMMUNITY

PEER GROUPS, USER GROUPS, INDUSTRY CONNECTIONS

Join the ConnectWise Community
The IT Nation

Groundbreaking MSP community
IT Nation Evolve

Coaching & peer groups
IT Nation Share

ConnectWise product training
Virtual Community

Partner peer connections
The Invent Program

Third-party integration certification
Join the ConnectWise Community
The IT Nation

Groundbreaking MSP community
IT Nation Evolve

Coaching & peer groups
IT Nation Share

ConnectWise product training
Virtual Community

Partner peer connections
The Invent Program

Third-party integration certification
Explore The IT Nation


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




EVENTS

GLOBAL INDUSTRY CONFERENCES AND EXPERIENCES

Events
IT Nation Connect

Premier MSP industry conference
IT Nation Secure

MSP cybersecruity industry conference
Automation Nation

AI & hyperautomation training
IT Nation Sydney

Regional MSP industry conference
IT Nation London

Regional MSP industry conference
IT Nation Share (User Groups)

ConnectWise product training
Events
IT Nation Connect

Premier MSP industry conference
IT Nation Secure

MSP cybersecruity industry conference
Automation Nation

AI & hyperautomation training
IT Nation Sydney

Regional MSP industry conference
IT Nation London

Regional MSP industry conference
IT Nation Share (User Groups)

ConnectWise product training
Explore all events


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




RESOURCES

BUSINESS-DRIVING INSIGHTS AND GUIDANCE

Explore Resources
Webinars
Blog
eBooks
Case studies
Industry reports
Feature sheets
On demand demos
Podcasts

Product Innovation Webinars
ConnectWise product updates
Product Roadmap

 Product innovations and updates
Explore Resources
Webinars
Blog
eBooks
Case studies
Industry reports
Feature sheets
On demand demos
Podcasts

Product Innovation Webinars
ConnectWise product updates
Product Roadmap

 Product innovations and updates
Explore all resources


See our latest product innovations that enhance your ConnectWise experience.
View roadmap>>




WHY CONNECTWISE

About Us
About ConnectWise
Mission & Vision
History
Careers
Leadership
Board of Directors
Partner Program
Growth and scaling resources
Philanthropy
Partner Referral
ConnectWise referral reward program
Company Updates
Press Room
Awards
Case studies

Asio—The MSP Platform

The only truly unified platform purpose-built for MSPs.
Learn more >>




SUPPORT

 * Partner Support
   
   ConnectWise solution resources

 * Partner Education
   
   Certifications and resources


PARTNER SUPPORT

CONNECTWISE SOLUTION RESOURCES

Get Support
ConnectWise Home

Solution access and product news
Documentation

Product info and manuals
Virtual Community

Partner peer connections
Lookup My Account Team
Account support and management
Get Support
ConnectWise Home

Solution access and product news
Documentation

Product info and manuals
Virtual Community

Partner peer connections
Lookup My Account Team
Account support and management

Partner Support

Access your products, see announcements, and find support
Log in to ConnectWise Home  >>




PARTNER EDUCATION

CERTIFICATIONS AND RESOURCES

Explore Partner Education
ConnectWise Certify™
Industry training and certifications
University

Partner tools, resources, courses
Modes Theory™
Business growth framework
Explore Partner Education
ConnectWise Certify™
Industry training and certifications
University

Partner tools, resources, courses
Modes Theory™
Business growth framework

Service Leadership, Inc.

Discover total profit solutions for IT companies.
Learn more >>



 1. Home
 2. ConnectWise Blog
 3. Cybersecurity
 4. 9 ways to eliminate SIEM false positives


9 WAYS TO ELIMINATE SIEM FALSE POSITIVES

Posted:
06/14/2023
| By: Kevin Prince
How to choose the right SIEM solution
Get My Guide

If you have a SIEM or are about to implement one, then you're probably
struggling with one of the biggest challenges in cybersecurity—false positives. 

According to Orca Security's 2022 Cloud Security Alert Fatigue Report,
cybersecurity teams are inundated with cloud security alerts—59% of respondents
receive more than 500 of these alerts per day. And because of the sheer volume
of alerts needing to be addressed, 55% of respondents said that very real,
critical alerts are being missed, often on a daily or weekly basis. But the
problem doesn't come from a lack of people—it comes from false positives.

Useless alerts often take the same amount of time to investigate as real ones.
The traditional approach—which a lot of MSSPs still use today—is to hire a huge
team of people to attempt to review every alert. Given the survey results and
recent cybersecurity headlines, how well do you think this works?

If you want to catch cybersecurity threats in your environment, you have to
focus on eliminating false positives so that the security experts you do have
can focus on remediating real problems. As we've seen, this is a process and
technology issue. Simply adding more people is not the solution. Cybersecurity
threats and attacks need to be dealt with efficiently, so today, we're going to
go through our top nine tips for eliminating false positives in your SIEM
environment.

1. PROPERLY DEFINE FALSE POSITIVES

An accurate alert or notification should be defined as anything that requires
immediate action—and that's it. Anything else alerting you is a false positive.
Not because it didn't happen but because there is no real action to take. Using
this definition rather than just "what is an accurate alert regardless of
criticality" will dramatically help you streamline your IT resources as it
pertains to alert management.

This is one of the hardest concepts for security operations managers to accept.
To help, ask yourself (or your  /provider) this question for every possible
alert: "When the team gets this alert, what action will they take?" If the
answer is "uh…" or "none, but….", then that alert would be a false positive.

Don't worry—we're not saying you will never see this information. But to help
avoid alert fatigue, it should show up on a report your team regularly reviews,
not as an alert that opens a ticket. 

2. GET RID OF RULES YOU DON'T NEED

This sounds obvious, but you would be amazed how many people install a SIEM and
leave every default rule turned on. Many rules are designed specifically for a
particular network device or IT system. If you don't have that system or device
in your network, disable the rule! Leaving it enabled will only create false
positives and lead to alert fatigue. While you're at it, make sure the rules
that remain active actually detect what you think they do. Many default rules in
a SIEM are often mislabeled or have other errors, so check carefully!

3. TUNE THE RULES TO YOUR SPECIFIC ENVIRONMENT THRESHOLDS

Rules are really nothing more than, "This thing happened this many times over
this period of time…." or a combination of such things. The appropriate "counts"
and thresholds in your environment are very different from other environments.
These thresholds need to be adjusted exactly between what is "normal" traffic in
your environment and what is abnormal traffic. This requires setting up a
network baseline by running the system for several weeks and analyzing the
traffic to know the appropriate thresholds for each rule. Believe it or not,
very few companies take the time to tune their SIEM to their actual environment!
The reality is many good IT folks don't know how to do this accurately, and it
may require a SIEM expert.

4. CONTEXT IS KING

Most SIEMs don't have this capability, and it's key in eliminating false
positives, so I hope you are reading this before you purchase your SIEM. Here's
an example to help illustrate this:

You get an alert from your SIEM stating it has detected a SQL injection attack
against one of your servers. That is serious, right?! Well, it's really only
serious if you have SQL on that server. Otherwise, it is just another false
positive. A good SIEM has the ability to look at the configuration of your
systems to determine if an attack can be successful. Configuration management
data included within the SIEM gives you an enormous advantage to eliminate some
of the peskiest false positives. Ask your SIEM provider if their solution
incorporates change management information and has a change management database
(CMDB). This eliminates the worst kind of false positives, the sleep-stealing
alerts that wake you up at 3:00am. No one wants that, and you need to understand
the context of the network systems to eliminate these false positives.

By the way, if your SIEM doesn't have detailed configuration and asset
information for critical context, you may want to view a live demo to see how
ConnectWise SIEM™ can work for you, and contact us for a new SIEM!

5. ADJUST THE CRITICALITY TO YOUR ENVIRONMENT

Remember we said that only events that require action now should be alerts and
that low-level alerts and most medium-level events don't need immediate
action—therefore, they should not be alerts? These should get rolled up into a
report that is delivered to the right person at an appropriate frequency,
perhaps weekly. With that in mind, many SIEM vendors set their default
criticality to a level that's way too high for most environments. Something that
is critical in someone else's environment may only be medium level in yours. Do
not trust the default criticality setting. You must review this in the context
of "What will we do when this alert is sent,".

6.   USE A THREAT FEED AND GEOLOCATION DATA

Most SIEM technologies allow you to blend outside data into the system to get
higher accuracy. A threat feed can be used to increase the accuracy of events
through cross-correlation and context. For example, if an IP range in a threat
feed is from a known hacker cell, it can increase the criticality of that event
to high. Geolocation data can also be used to increase or decrease criticality
based on the source or destination of your network traffic. With this, your SIEM
can automatically detect the difference between inter-office traffic, remote
traffic, and foreign traffic.

A word of caution on threat feeds—A low-quality threat feed (usually free ones)
can actually increase your false positives tremendously! If you're going to use
a threat feed, use a high-quality one that updates regularly, is constantly
cleaned of stale information, and is specific in its threat data rather than
generically blocking huge network segments, such as the ConnectWise CRU threat
feed. 

7. TRUST YOUR SECURITY DEVICES

Most organizations have cybersecurity devices such as a firewall or an intrusion
prevention system that block malicious traffic. Many people configure their SIEM
to alert them for an event that was already stopped. If your firewall is
blocking that attacker, why would you want a ticket on that? Report this
somewhere, sure, but don't open a ticket only to make someone close it later.
Remember, if it doesn't require action right now, you shouldn't be getting an
alert.

8. IGNORE LOW LEVEL ALERTS

Most low level alerts can be turned off entirely. But if there are low level
alerts that you do want to track, do that with a report periodically. I'm sure
you're getting tired of hearing this by now, but if it doesn't require action,
you shouldn't be getting an alert.

9. TUNING IS NOT A ONE-TIME EVENT

Anyone who thinks that they can set up their SIEM and it will remain highly
tuned is sorely mistaken. Security information and event management systems, by
their very nature, require a lot of ongoing care and feeding—daily. Adjustments
will need to be made when network devices are added, removed, or updated. Tuning
will be needed when firmware updates occur or software is upgraded. Even if
nothing changes in your environment, the threat landscape changes, which
requires changes to your SIEM, not to mention your SIEM should be getting
updates with new rules and rule updates that need to be applied and maintained.
A properly tuned SIEM will be your greatest cybersecurity asset. A neglected
SIEM or a SIEM maintained by untrained staff will be a nightmare, a huge waste
of money, and raise your risk exposures. Most importantly, when you get a false
positive, use it as a feedback loop to adjust the SIEM so that the same false
positive doesn't show up again. If you just clear the alert and don't make a
change, it will happen again and again and again. Get in the habit of adjusting
the SIEM right away so you save scores of hours in the future.


IT'S WORTH IT TO WORK WITH A SIEM EXPERT

While this may sound easy to do, SIEMs are very complicated. I mean, would you
trust a guy to do surgery on you that had only learned from an online video? No!
When you run the math, it's far less expensive to outsource management and
tuning your SIEM to an expert than to do it yourself—If you get the right
partner.

The good news is that this is what ConnectWise does best! Depending upon the
SIEM technology you're using, we can manage and tune your SIEM initially and
ongoing to ensure you practically eliminate all your false positives.

Haven't selected a SIEM yet? Download this eBook for tips on what to look for in
a SIEM and how to add it as a service.

We have some amazing options for you, including our SIEM hosted by us or an
on-premise managed SIEM that you host at your data center or in your cloud
environment. Using ConnectWise for your SIEM needs means getting the most out of
your SIEM investment and getting the best possible cybersecurity and compliance
available at a fraction of the cost of doing it yourself.


RELATED BLOG POSTS

<< Back to All Blog Posts
10/02/2023
2 min read
EDR vs. SIEM: How they differ and why you need both
By: Jay Ryerse
EDR and SIEM software shouldn’t be an “either or” scenario. Learn why you need
both of these powerful tools to help your clients.
Read the blog
Cybersecurity
10/11/2021
3 min read
Cybersecurity SOC, SIEM & SecOps: How they work together
By: Wayne R. Selk, CDPSE
There can be a lot of noise in cybersecurity, but aligning the right tools with
the right teams helps cut through the clutter. Ensuring that your cybersecurity
SOC and SecOps teams have full visibility within the SIEM solution is the first
step.
Read the blog
Cybersecurity


RECOMMENDED

How to Build an MSSP inside your MSP | ConnectWise
Here's a step-by-step look at how to build an MSSP offering inside your MSP
(managed service provider).
Learn more >>
Why ConnectWise is the top MSP choice for cybersecurity solutions
Dive into ConnectWise Cybersecurity Management! Discover how solutions from
ConnectWise can help you protect against, detect, and respond to potential
cyberthreats facing your business and clients.
Learn more >>
Ready to talk?

Contact Us

Chat Now

800.671.6898
Partner Support
Solutions
 * Asio™ platform
 * Cybersecurity and Data Protection
 * Unified Monitoring and Management
 * Business Management
 * Solution Marketplace

For Partners
 * ConnectWise University™ Login
 * ConnectWise Home Login
 * ConnectWise Virtual Community™
 * Getting Help
 * Documentation
 * Partner Services
 * Partner Communications
 * Partner Referral

Resources
 * Resource Center
 * Blog
 * Events
 * Webinars
 * Podcasts
 * The IT Nation
 * Online Community

Company
 * Mission & Vision
 * History
 * Awards
 * Press Room
 * Careers
 * Distributors
 * Contact Us
 * Careers


Stay up to date
CountryAfghanistanAlbaniaAlgeriaAland IslandsAmerican
SamoaAnguillaAndorraAngolaAntilles - NetherlandsAntigua and
BarbudaAntarcticaArgentinaArmeniaAustraliaAustriaArubaAzerbaijanBosnia and
HerzegovinaBarbadosBangladeshBelgiumBurkina
FasoBulgariaBahrainBurundiBeninBermudaBrunei
DarussalamBoliviaBrazilBahamasBhutanBouvet
IslandBotswanaBelarusBelizeCambodiaCameroonCanadaCape VerdeCentral African
RepublicChadChileChinaChristmas IslandCocos IslandsColombiaCongoIvory CoastCook
IslandsCosta RicaCroatiaCyprusCzech RepublicDemocratic Republic of the
CongoDjiboutiDenmarkDominicaDominican RepublicEcuadorEgyptEl SalvadorEast
TimorEstoniaEquatorial GuineaEritreaEthiopiaFinlandFijiFalkland IslandsFederated
States of MicronesiaFaroe IslandsFranceFrench GuianaFrench
PolynesiaGabonGambiaGermanyGhanaGibraltarGreat
BritainGrenadaGeorgiaGreeceGreenlandGuineaGuadeloupeS. Georgia and S. Sandwich
IslandsGuatemalaGuamGuinea-BissauGuyanaHong KongHeard Island and McDonald
IslandsHondurasHaitiHungaryIndonesiaIrelandIsraelIndiaBritish Indian Ocean
TerritoryIraqItalyJamaicaJordanJapanKenyaKyrgyzstanKiribatiComorosSaint Kitts
and NevisKorea SouthKuwaitCayman IslandsKazakhstanLaosLebanonSaint
LuciaLiechtensteinSri
LankaLiberiaLesothoLithuaniaLuxembourgLatviaLibyaMacedoniaMacaoMadagascarMalaysiaMaliMalawiMauritaniaMarshall
IslandsMartiniqueMauritiusMayotteMaltaMexicoMoroccoMonacoMoldovaMongoliaMyanmarNorthern
Mariana IslandsMontserratMaldivesMozambiqueNamibiaNew CaledoniaNigerNorfolk
IslandNigeriaNicaraguaNetherlandsNorwayNepalNauruNiueNew
ZealandOmanPanamaPeruPapua New GuineaPhilippinesPakistanPolandSaint Pierre and
MiquelonSerbia and MontenegroPitcairnPuerto RicoPalestinian
TerritoryPortugalPalauParaguayQatarReunionRomaniaRussian FederationRwandaSaudi
ArabiaSamoaSaint HelenaSaint Vincent and the GrenadinesSan MarinoSao Tome and
PrincipeSenegalSeychellesSierra LeoneSingaporeSlovakiaSloveniaSolomon
IslandsSomaliaSouth AfricaSpainSudanSurinameSvalbard and Jan
MayenSwedenSwitzerlandSwazilandTaiwanTanzaniaTajikistanThailandTimor-LesteTogoTokelauTongaTrinidad
and TobagoTunisiaTurkeyTurkmenistanTurks and Caicos
IslandsTuvaluUkraineUgandaUnited Arab EmiratesUnited KingdomUnited StatesUnited
States Minor Outlying IslandsUruguayUzbekistanVanuatuVatican City
StateVenezuelaVirgin IslandsVirgin IslandsViet NamWallis and FutunaWestern
SaharaYemenZambiaZimbabwe
Submit













©2024 ConnectWise, LLC. All rights reserved.
Terms Privacy Policy Trust


We use cookies to enhance site navigation, analyze site usage and assist in our
marketing efforts. You can accept, reject or customize your preferences by
clicking the cookie settings button. Our privacy policy provides more
information and explains how to amend your cookie settingsPrivacy Policy
Reject All Cookies Accept All Cookies
Customize Choices




PRIVACY PREFERENCE CENTER




 * YOUR PRIVACY


 * STRICTLY NECESSARY COOKIES


 * PERFORMANCE COOKIES


 * TARGETING COOKIES


 * FUNCTIONAL COOKIES

YOUR PRIVACY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

View Vendor Details‎

PERFORMANCE COOKIES

Performance Cookies


These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

View Vendor Details‎

TARGETING COOKIES

Targeting Cookies


These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

View Vendor Details‎

FUNCTIONAL COOKIES

Functional Cookies


These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

View Vendor Details‎
Back Button


VENDORS LIST

Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Clear
checkbox label label
Apply Cancel
Confirm My Choices
Reject All Allow All