THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
What is this?
In order to understand the needs and requirements of SOC users for Metron, we are going to use this page to collect questions to ask SOC users.
The below is the process that will be followed to create final questionnaire:
- The community is providing feedback via the following apache metron mailing thread on customer survey . If you have input to this for this questionnaire, please send via this thread.
- Feedback from the thread in (1) will be added to this wiki page.
- On 12/21, the questions from this wiki will be used to create a formal survey via Survey Monkey, Google form, or something similar
- The final survey will be published for anyone to send out.
Running List of Questions for the Survey/Questionnaire
| Identifier | Question | Submitted By |
|---|---|---|
| Q1 | What specific use cases and cyber security domain problems are you trying to solve with Metron? | Dave Hirko |
| Q2 | How would you prioritize, in terms of importance, the use cases and challenges below that the SOC is tasked to solve:
| Dave Hirko
|
| Q3 | What are key challenges and limitations of the current SIEM and security analytics tools that you use today? | George Vetticaden |
| Q4 | How would you prioritize the challenges today with the existing security tooling you use:
| George Vetticaden |
| Q5 | What analytical and/or correlation capabilities and features would you like Metron to support for the data:
| David Hirko |
| Q6 | How would you rate your SOC’s data science and analytical capabilities today? | David Hirko |
| Q7 | Does your SOC have any plans to enhance its data science and analytical capabilities now or in the future? | David Hirko |
| Q8 | What data retention capabilities do you require Metron to support? | David Hirko |
| Q9 | What compliance regimes, if any, does your SOC tools and capabilities need to comply with to support the needs of your business? | David Hirko |
| Q10 | What are the key challenges with the collection, ingestion and storage of telemetry data with your current security tooling? | George Vetticaden |
| Q11 | What security/telemetry sources are important to stream into Metron Security Data Lake Platform? Supporting a device on the Metron platform means providing:
| George Vetticaden |
| Q12 | What type of enrichment would you like to do to the security telemetry data? (e.g: Geo, Whois) | George Vetticaden |
| Q13 | What type of enrichment capabilities does your current security tooling NOT provide? Is enrichment of the data in real-time a critical requirement? Is storing the enriched and raw data a critical requirement? | George Vetticaden |
| Q14 | What are the different threat intel feeds you subscribe to (public, private, tec..)? Which vendor do you get the feed from and what is the format. Supporting an out of the box threat intel feed means the following supporting parsers for the intel feed to persist the feed store in normalized form. | George Vetticaden |
| Q15 | What are critical requirements for threat intel feed integration with Metron? For example, is cross referencing your threat intel feeds against the original and enriched telemetry data a critical requirement? | George Vetticaden |
| Q16 | What are the critical functions you would like to perform on the streaming security telemetry data as its coming in real-time in as opposed to after it lands? | George Vetticaden |
| Q17 | Most the major security/SIEM vendors claim to have capabilities that reduce and prioritize the number of alerts. What has been your experience with these capabilities? Are risk/priority based correlation engines working to reduce the number of alerts? What are the challenges that you are experiencing? What are key requirements/capabilities that you would like to see in a next-gen correlation engine in Metron? | George Vetticaden |
| Q19 | Most of the major security/SIEM vendors have static rules engine where an analyst can define simple static rules that get applied after the data has landed or been indexed. Do you feel Metron should provide similar functionality or rather focus its efforts on building relevancy/correlation data science engines/models that can create higher level meta alerts? Does Metron need to provide both? What is most important to build out first? | George Vetticaden |
| Q20 | Can you provide a list of your common static rules that you would like to have Out of the box support for in Metron? | George Vetticaden |
| Q21 | Do you envision Metron replacing your SIEM solution or complimenting it? | George Vetticaden |
Context for the Questions Above
- Q1, Q2 - It would be interesting to understand the higher level use case domain problems SOC’s are potentially trying to solve with Metron before delving into specific data sources. Use cases drive data sources. For example, we are focused on APT’s, which then flows down to specific data sources we would instrument and parse, UI visualizations and analytics. Perimeter defense is a different domain that Metron can solve, but then flows down to different data sources, UI visualizations, etc. We saw one customer use OpenSOC for log aggregation. One idea here is maybe have a list of use cases and have the users prioritize their needs as part of the survey.
- Q5 - Metron currently has zero-to-limited analytical capabilities. Its more data acquisition, aggregation, filter, storage, and visualization. We are very interested to understand more about the SOC’s data analysis requirements (James has mentioned a correlation engine for the roadmap a few times which is relevant here).
- Q6, Q7 - The Metron UI has been geared for operational analysis vs analytical analysis (I don’t count wireshark as analytical). We have one progressive customer who is starting to bring very capable data scientists into the SOC to enhance the typical SOC operational analysts. Again, this organizational dynamic in the SOC plays out to Metron in terms of incorporating things like Apache Zeppelin versus just making Kibana/Banana incrementally better. Would definitely like to know what customer’s are doing on this front from a SOC staffing and/or organizational perspective.
- Q8 - One customer wanted to store collected data for their enterprise for 18 months on the OpenSOC/Metron HDFS cluster in order to support more advanced analytics. It would be interesting to understand data retention requirements and policies. Soon there will be more rigid compliance implications for storing data that helps uncover
- Q9 - Cybersecurity and its various domains are going to be regulated more and more. There are going to be more reporting requirements for enterprise companies in terms of sharing cyber related events. The SOC is going to play a larger role with respect to compliance, which could have implications related to Metron technical features or prioritization.