Detection and Alerting: Selecting a SIEM

This report provides a concise overview of essential SIEM requirements to build or enhance a detection and alerting program, covering log ingestion and normalization, creation and indexing of custom fields, event correlation and rules engines (including scheduled searches and alerting), analytics/reporting/dashboards, tool integrations, threat intelligence usage (feed alerting and enrichment), and User Behavior Analytics, and concludes that SIEM choice should be driven by organizational needs and use cases.