Log Quality Index for SIEM Log Source Value Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security Information and Event Management (SIEM) systems face challenges in determining the value of log sources for incident response, as security engineers lack the necessary background to assess log data effectively, leading to incomplete data and inefficient decision-making during security investigations.
Innovation Solution
A Log Source Value Tool is implemented, which generates a Log Quality Index (LQV) comprising device criticality and usefulness values, enabling security analysts to quantify the value of log sources and improve data-driven decision-making.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If security engineers deploy SIEM systems without Incident Response background, then SIEM technology can be implemented, but the ability to assess and prioritize log data value deteriorates
Solution Approach 1:
The patent introduces an automated log source evaluation tool as an intermediary between log data collection and security analysis. This tool objectively assesses log source value using predefined criteria (data quality, completeness, timeliness, relevance) without requiring expert human judgment, thus resolving the contradiction between easy deployment and precise assessment
Solution Approach 2:
The patent replaces the manual expert assessment mechanism with an automated computational evaluation system. The tool uses algorithmic scoring and ranking to substitute human expert judgment, enabling precise log value assessment without requiring security engineers to have Incident Response background knowledge
2Quantity of substance
If all log sources are collected without evaluation, then complete data availability is achieved, but resource efficiency deteriorates due to processing irrelevant logs
Solution Approach 1:
The patent extracts and evaluates specific value indicators from log sources (data quality, completeness, timeliness, relevance) to determine which logs warrant processing. This selective extraction approach maintains availability of critical log data while filtering out irrelevant information before resource-intensive processing occurs
Solution Approach 2:
The patent implements partial evaluation by assessing only the most critical value indicators of each log source rather than analyzing every detail. This partial action approach provides sufficient discrimination to prioritize logs effectively without the excessive resource consumption that would result from exhaustive analysis of all log characteristics
3Adaptability or versatility
If log sources are evaluated subjectively without standardized metrics, then flexibility in assessment is maintained, but measurement consistency deteriorates
Solution Approach 1:
The patent transforms the subjective assessment process into an objective measurement system by defining specific parameters (data quality score, completeness score, timeliness score, relevance score) with standardized calculation methods. This parameterization maintains flexibility in capturing different log characteristics while ensuring consistent measurement across all log sources
Solution Approach 2:
The patent segments the overall log evaluation into distinct measurable components (data quality, completeness, timeliness, relevance). Each segment is evaluated independently using standardized criteria, then aggregated to produce an overall log source value score. This segmentation enables both consistency in measurement and flexibility in capturing multidimensional log characteristics
Data Source
AI summary
An embodiment of the present invention is directed to quantifying the value of an individual log source sent to the SIEM. Through vendor-agnostic measurement, an algorithmic model utilized by a Log Quality Value (LQV) index enables security engineers and incident response (IR) teams to determine which logs provide the most value for security investigations. An embodiment of the present invention recognizes a positive correlation between the LQV index and critical logs used to investigate the attack. An embodiment of the present invention may be extended to evaluate the LQV algorithms against a more extensive dataset from live production environments and to further measure the tool effectiveness through periodically comparing the LQV index to logs used to detect security incidents.