28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨ÔÙ´ÎÈëΧGartner SIEMħÁ¦ÏóÏÞ

°ä²¼¹¦·ò 2021-07-03

6ÔÂ29ÈÕ £¬È«ÇòȨÍþITÕ÷ѯ»ú¹¹Gartner°ä²¼ÁË2021ÄêSIEMħÁ¦ÏóÏÞ£¨Magic Quadrant for Security Information and Event Management£©»ã±¨ £¬28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨ÔÙ´ÎÈëΧGartner SIEMħÁ¦ÏóÏÞ £¬³ÉΪ¹úÄÚ°²È«ÁìÓòÖÐΨÖðÒ»¼ÒÈý´ÎÈëΧGartner SIEMħÁ¦ÏóÏ޵ݲȫÆóÒµ¡£


1.png



GartnerµÄ·ÖÎöʦ¶Ô28Ȧ¼¯ÍÅÌ©ºÏ°²È«ÖÎÀíÆ½Ì¨µÄ¡°¶àά¶È·ÖÎöÄÜÁ¦ £¬×Ô¶¯»¯±àÅÅÄÜÁ¦ £¬½»»¥Ê½Õ¹Ê¾ºÍÓû§ÂÄÀú £¬ÖÇÄÜ»¯ÔËά²Ù×÷ÄÜÁ¦¡±µÈ·½Ãæ´ÍÓëÁ˸߶ÈÈϿɡ£


ǰÁ½´ÎÈëΧSIEMħÁ¦ÏóÏÞ £¬GartnerÆÀ¼Û28Ȧ¼¯ÍÅÌ©ºÏ°²È«ÖÎÀíÆ½Ì¨×¨Ò»ÓÚ´óÖÐÐͿͻ§ÒÔ¼°¹¤Òµ»¥ÁªÍøÁìÓòµÄÍøÂç¼à²â΢·çÏÕÖÎÀíµÄÔËÓªÐèÒª £¬¾ß±¸¶à²úÆ·£¨Ä£¿é£©½â¾ö¹æ»®¼¯³ÉÄÜÁ¦ £¬ÌṩÁËÖ÷ÌâµÄSIM £¬SEMÖ°ÄÜ £¬ÒÔ¼°Í¨¹ýNTAºÍUSM-ICSÌṩÁËOTÉ豸µÄÁ÷Á¿ºÍ¼à¿Ø·ÖÎöÄÜÁ¦ £¬Í¬Ê±¼Ü¹¹¼ò½à £¬¾ß±¸¸ßÀ©´óÄÜÁ¦ £¬¿ÉʵÏÖˮƽµ¯ÐÔÍØÕ¹ £¬ºÏÓÃÓÚ·ÖÆç¹æÄ£µÄ×éÖ¯¡£


ÓбðÓÚǰÁ½´ÎÈëΧµÄÆÀ¼Û £¬½ñÄêµÄGartner»ã±¨³ÁµãÆÀ¼ÛÁË28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨µÄÈçϱ䶯 £¬Ô̺¬°²È«±àÅÅÓë×Ô¶¯»¯ÏìÓ¦£¨SOAR£©ÄÜÁ¦ £¬Íþвµý±¨ÀûÓ÷ÖÎö¡¢Íþв¸ú×ÙÒÔ¼°È¡Ö¤ËÝÔ´Ö°ÄÜ £¬¼ÓÇ¿µÄÍøÂçÁ÷Á¿·ÖÎöÄÜÁ¦µÈ £¬¶øÕâЩÄÜÁ¦Ò²ÊÇÔÚ´Óǰ¼¸ÄêÕë¶Ô¹úÄÚ¹¥·ÀÑÝÁ·ÒÔ¼°³£Ì¬»¯µÄ°²È«±£ÏÕÖгÖÐøÑݽø³öÀ´µÄ¡£


ͬʱ³½ÎöʦÒÔΪ̩ºÏ°²È«ÖÎÀíÆ½Ì¨²úÆ·ÔÚ·ÖÎöÄÜÁ¦·½ÃæµÃ·Ö×î¸ß £¬Ô̺¬£ºÕ½Êõ»¯¶àά¶È¹ØÁª·ÖÎö£¨Ô̺¬Ç°ÌáÊ÷ºÍͼÐλ¯ÊÓͼ£©¡¢¸ß¼¶Åú´¦ÖúÍÁ÷´¦Öü¼Êõ¡¢ÖÇÄÜ·ÖÎö¼¼Êõ£¨Ô̺¬Óû§ÐÐΪ·ÖÎöUEBAµÈ£©¡¢ÌṩÔÚTIPÖлñÈ¡Íþвµý±¨²¢½øÐеý±¨·ÖÎöµÄÄÜÁ¦µÈ¡£


´ÓGartnerµÄ·ÖÎö»ã±¨ÉÏÄܹ»¿´µ½ £¬28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨µÄ¹Ø¼üÄÜÁ¦ÆÀ¼ÛÒѾ­´ïµ½Á˹ú¼ÊÖ÷Á÷ˮƽ £¬²úÆ·ÏÖÓÐÖ°ÄܺÍ·±ê¹æ»®Ò²ÇкϹú¼Ê³±Ë® £¬ÔÚÖйúÊг¡»ñµÃµÄ³É¹¦»ñµÃÁ˹ú¼ÊÈϿɡ£Í¬Ê± £¬¼«¶ÈÖµµÃÐÀϲµÄÊǽñÄêµÄÈëΧÃûµ¥ÖгöÏÖÁËÁ½¸ö¹úÄÚÆóÒµ £¬ÕâÒ²´ú±í׏úÄÚµÄSIEMÀàÆ½Ì¨²úÆ·ÕýÖ𲽵õ½¹ú¼ÊÈϿɡ£


ÁíÒ»·½Ãæ £¬GartnerµÄÆÀ¹ÀÊÇ·ÅÑÛÈ«ÇòÊг¡ £¬´ÓÈ«Çò»¯ÊÓ½ÇÀ´ÉóÊÓËùÓÐ²ÎÆÀÆóÒµµÄ¼¼Êõ¡¢Êг¡ºÍÒµÎñˮƽ¡£ÓÉÓÚĿǰ28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨²úÆ·µÄÊг¡ÖØÒª¾Û½¹ÔÚÖйúÊг¡ £¬¶Ô¹ú¼ÊÊг¡µÄÆô·¢Éд¦ÓÚÆð²½½×¶Î £¬Òò¶øÔÚħÁ¦ÏóÏ޵ĵØÎ»Êܵ½Á˿϶¨Ó°Ïì £¬Ëæ×ÅÎÒÃǼ¼ÊõÄÜÁ¦µÄ²»ÐÝÌá¸ß £¬¹úÄÚÊг¡µÄѸ¿ì·¢Õ¹ÒÔ¼°È«Çò»¯Êг¡µÄÖð²½ÍØÕ¹ £¬ÏàÐÅ»áÂõÉϸü¸ßµĄ̈½×¡£


ÔÚÊý×Ö»¯³¡¾°»¯Ï¼ùÐÐ×ÔÖ÷´´Ð £¬³ÖÐø¹¹½¨Ö÷Ì⾺ÕùÁ¦


Gartner¶Ô°²È«ÐÅÏ¢ºÍÊÂÎñÖÎÀí£¨SIEM£©²úÆ·½â¾ö¹æ»®²à³ÁÓÚË¢ÐÂÐԵļ¼ÊõºÍ²½Öè £¬ÒÔÆÚÂú×ã¿Í»§½«À´µÄ°²È«ÐèÒª £¬³ö¸ñÊǶԡ°¼Ü¹¹²¿Êð¡¢Êý¾ÝÍøÂçÓëÖÎÀí¡¢·ÖÎöÄÜÁ¦¡¢ÄÚÈÝÖÎÀí¡¢ÊÂÎñÏìÓ¦ÓëÖÎÀí¡¢×Ô¶¯»¯Óë±àÅÅ¡¢ÔËάÖÎÀí¡¢Óû§ÂÄÀúÓë½çÃæ¡¢ºÏ¹æÄÜÁ¦¡¹Øâ9¸ö·½ÃæµÄÄÜÁ¦ÆÀ¹ÀÌá³öÁ˽ϸߵÄÒªÇó £¬ÕâЩÄÜÁ¦Óë¹úÄÚÊý×Ö»¯¾­¼ÃתÐͲ¼¾°ÏÂ¶ÔÆ½Ì¨ÔËÓªÄÜÁ¦ÐèÒª¸ß¶ÈÆ¥Åä £¬³ö¸ñÊÇÊÂÎñÏìÓ¦Óë×Ô¶¯»¯±àÅÅ £¬ÔÚÆ½Ì¨½¨ÉèÖд¦ÓÚÕ½Êõ¼Ü¹¹µÄÖÐÊàµØÎ» £¬SOAR²à³ÁÓÚ¹¤×÷Á÷¡¢Á÷³Ì £¬ÔÚÕû¸ö±ðϵÖгäÈÎÁ˸÷ÀàÆ½Ì¨¡¢¹¤¾ßÖ®¼ä´«ÊäÊý¾ÝµÄ´úÀí½ÇÉ«¡£°²È«±àÅÅ £¬×Ô¶¯»¯ºÍÏìÓ¦Ö°ÄÜÔòÔÚÔ®ÊÖÍøÂ簲ȫרҵÈËÔ±¼ø±ð¸æ¾¯µÄͬʱ £¬Ò²Äܹ»×÷ΪÍþвµý±¨³ö²úºÍÏû·ÑµÄÖÐÑëÊàŦ¡£»ùÓÚ´Ë £¬±¾´ÎµÄGartner»ã±¨¶Ô28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨ÖеÄSOARÄÜÁ¦½øÐÐÁ˳Áµã±ê×¢¡£



×÷Ϊ¹úÄÚ°²È«ÖÎÀíÆ½Ì¨Áì¾üÆ·ÅÆ £¬28Ȧ̩ºÏ°²È«ÖÎÀíÆ½Ì¨½üÁ½ÄêÀ´³ÖÐøÉî¿ÌÔËÓª·þÎñ £¬À©´óÔÆ²¿Êðģʽ £¬´òÔ칤ҵ»¥ÁªÍøÆ½Ì¨²úÆ· £¬³ÖÐø¸³Äܼ¯ÍÅÈý´óÕ½ÊõÐÂÒµÎñ¡°°²È«ÔËÓª¡¢Ôư²È«¡¢¹¤Òµ»¥ÁªÍø°²È«¡±¡£


Æù½ñΪֹ £¬28Ȧ¼¯ÍÅÒѾ­ÍƳöµÚËÄ´úƽ̨µ×²ã¼Ü¹¹ £¬Õ¼ÓÐËÄÊ®ÓàÏî²úƷרÀûºÍÈýÊ®¶à·ÝÈí¼þÖøÊöȨ £¬È«ÐÂµÄµ×²ãÆ½Ì¨¼Ü¹¹Ìṩ¸ß»úÄÜ¡¢¸ß¿ÉÓᢸü½Ã½ÝµÄÉϲãÒµÎñÖ§³Ö £¬Ôڶೡ¾°ÒµÎñ»¯Ì¬ÊƸÐÖª£¨BCSA£© £¬°²È«±àÅźÍ×Ô¶¯»¯ÔËÓª£¨SOAR£©¡¢Êý¾Ý²É¼¯×Ô¶¯·¶Ê½»¯£¨AN£©¡¢¶àµµ´Î¿ç¾ØÕóÔËË㣨Tran-Matrix Opt.£©¡¢ÖªÊ¶Í¼Æ×£¨KG£©¡¢Óû§ÊµÌåÐÐΪ·ÖÎö£¨UEBA£©¡¢Éî¶È¹ØÁª·ÖÎö£¨AA£©¡¢¿ÉÊÓ»¯Õ¹Ê¾£¨Visualization£©¡¢¼±¾ç½»¸¶£¨QD£©¡¢Íþвá÷ÁÔ£¨TH£©¡¢AI·ÖÎöÓëÖÇÄÜÏìÓ¦£¨AIA&IR£©¡¢Õ½Êõ»¯½»»¥Ê½¹ØÁª·ÖÎö£¨IPA£©¡¢¶àά¶È°²È«ÅäÖú˲飨MCVS£©µÈ·½ÃæÎª¿í´óÓû§³ÖÐøÌṩ×îÐÂµÄÆ½Ì¨¼¼ÊõºÍ²úÆ·Ö§³Ö¡£


ÔÚ¡°»¤º½Êý×ÖÖйú £¬Á캽ÐÅÏ¢°²È«¡±µÄÔ¸¾°Ï £¬½«À´ £¬28Ȧ¼¯ÍŽ«³ÖÐø¼ùÐÓװʵս»¯¡¢ÏµÍ³»¯¡¢³£Ì¬»¯¡±ÐÂÐж¯ £¬²»Ðݹ¹½¨ÌùºÏÓû§ÒµÎñºÍ³¡¾°µÄÖÇÄÜ»¯AI·ÖÎöÄ£ÐͺÍÏìӦϵͳ £¬Í¨¹ýƽ̨½«ÈËÔ±ºÍÁ÷³ÌÕûºÏ £¬ÐÎ³ÉÆëÈ«ÓÐЧµÄ°²È«ÔËÓªÖ§³Öϵͳ £¬ÔںϹæºÍÊý×Ö»¯³¡¾°µÄË«Çý¶¯Ï £¬Óë¿Í»§µÄÒµÎñÉî¶ÈÈÚºÏ £¬½áºÏ°²È«ÔËӪΪÓû§ÒµÎñ³¡¾°·þÎñ £¬ÎªÓû§Êý×Ö»¯×ªÐ͸ßÖÊÁ¿·¢Õ¹±£¼Ý»¤º½¡£