1.1 Sentinel Overview
Sentinel is a security information and event management solution that receives information from many sources throughout an enterprise, standardizes it, prioritizes it and presents it to you to make threat, risk, and policy-related decisions.
Sentinel automates log collection, analysis, and reporting processes to ensure that IT controls are effective supporting threat detection and audit requirements. Sentinel replaces these labor-intensive manual processes with automated, continuous monitoring of security and compliance events and IT controls.
Sentinel gathers and correlates security and non-security information from across an organization's networked infrastructure, as well as third-party systems, devices, and applications. Sentinel presents the collected data in a more sensible GUI, identifies security or compliance issues, and tracks remediation activities, to streamline previously error-prone processes and build a more rigorous and secure management program.
Automated incident response management enables you to document and formalize the process of tracking, escalating, and responding to incidents and policy violations, and provides two-way integration with trouble-ticketing systems. Sentinel enables you to react promptly and resolve incidents efficiently.
Solution Packs are a simple way to distribute and import Sentinel correlation rules, dynamic lists, maps, reports, and iTRAC workflows into controls. These controls may be designed to meet specific regulatory requirements, such as the Payment Card Industry Data Security Standard, or they may be related to a specific data source, such as user authentication events for an Oracle database.
With Sentinel, you get:
-
Integrated, automated real-time security management and compliance monitoring across all systems and networks
-
A framework that enables business policies to drive IT policy and action
-
Automatic documenting and reporting of security, systems, and access events across the enterprise
-
Built-in incident management and remediation
-
The ability to demonstrate and monitor compliance with internal policies and government regulations such as Sarbanes-Oxley, HIPAA, GLBA, FISMA and others. The content required to implement these controls is simply distributed and implemented using Solution Packs.
The following is a conceptual architecture of Sentinel, which illustrates the components involved in performing security and compliance management.
Figure 1-1 Conceptual Architecture of Sentinel
