In reply to Matt.

Thanks for reading and commenting Matt! You make a very fair point, one which was not lost on me as we've been developing this framework. By all means you can certainly just copy/paste from the SIEM (i.e. collecting its logic) and apply its reports/queries to the log management system. Of course you now have a redundant system, and you are still beholden to updates from the SIEM vendor to ensure you have adequate coverage for the current threats.

Regardless of 'real-time', the other issue is that you will not get everything from the SIEM vendor. Just yesterday I updated our log management system to query for over 8,000 unique domains known to be part of a watering hole attack that has only surfaced in the last two weeks. The SIEM would have no idea about those recent domains, nor have patterns to match for them as the HTTP connections to the bad domains look benign and typical.

I'll concede that the line between log management systems and SIEM appears somewhat blurry, however my point was that the log management solution allows for much more recency, flexibility with searching, and a wholly customizable framework to match any network, security strategy, or threat profile.