{"id":14890,"date":"2025-04-09T13:08:37","date_gmt":"2025-04-09T07:08:37","guid":{"rendered":"https:\/\/dtasiagroup.com\/top-4-tricks-to-reduce-siem-data-volume\/"},"modified":"2025-06-03T14:11:09","modified_gmt":"2025-06-03T08:11:09","slug":"top-4-meo-giam-khoi-luong-du-lieu-siem","status":"publish","type":"post","link":"https:\/\/dtasiagroup.com\/vi\/top-4-meo-giam-khoi-luong-du-lieu-siem\/","title":{"rendered":"Top 4 m\u1eb9o gi\u1ea3m kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u SIEM"},"content":{"rendered":"

\"\"<\/p>\n

Ng\u00e0y nay, c\u00e1c nh\u00f3m b\u1ea3o m\u1eadt \u0111ang b\u1ecb qu\u00e1 t\u1ea3i\u2014kh\u00f4ng ch\u1ec9 b\u1edfi c\u00e1c m\u1ed1i \u0111e d\u1ecda, m\u00e0 c\u00f2n b\u1edfi kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u.<\/strong> V\u1edbi m\u1ee9c t\u0103ng 28% h\u00e0ng n\u0103m v\u1ec1 l\u01b0\u1ee3ng log v\u00e0 chi ph\u00ed SIEM g\u1eafn li\u1ec1n tr\u1ef1c ti\u1ebfp v\u1edbi l\u01b0\u1ee3ng d\u1eef li\u1ec7u thu th\u1eadp, ng\u00e2n s\u00e1ch \u0111ang ph\u00ecnh to. Tuy nhi\u00ean, nhi\u1ec1u d\u1eef li\u1ec7u h\u01a1n kh\u00f4ng \u0111\u1ed3ng ngh\u0129a v\u1edbi b\u1ea3o m\u1eadt t\u1ed1t h\u01a1n. Tr\u00ean th\u1ef1c t\u1ebf, kh\u1ed1i l\u01b0\u1ee3ng log qu\u00e1 l\u1edbn th\u01b0\u1eddng l\u00e0m t\u0103ng nhi\u1ec5u, gi\u1ea3m kh\u1ea3 n\u0103ng quan s\u00e1t v\u00e0 l\u00e0m ch\u1eadm th\u1eddi gian ph\u1ea3n h\u1ed3i.<\/p>\n

Gi\u1ea3i ph\u00e1p? Thu th\u1eadp \u00edt d\u1eef li\u1ec7u h\u01a1n\u2014nh\u01b0ng ch\u1ea5t l\u01b0\u1ee3ng h\u01a1n.<\/strong>
Trong b\u00e0i vi\u1ebft n\u00e0y, ch\u00fang t\u00f4i s\u1ebd tr\u00ecnh b\u00e0y b\u1ed1n c\u00e1ch th\u1ef1c t\u1ebf \u0111\u1ec3 gi\u1ea3m kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u SIEM m\u00e0 kh\u00f4ng l\u00e0m m\u1ea5t \u0111i nh\u1eefng \u00fd ngh\u0129a quan tr\u1ecdng v\u1ec1 b\u1ea3o m\u1eadt.<\/p>\n

<\/h2>\n

V\u1ea5n \u0111\u1ec1 th\u1ef1c s\u1ef1: Kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u so v\u1edbi h\u1ea5t l\u01b0\u1ee3ng d\u1eef li\u1ec7u<\/strong><\/h2>\n

C\u00e1ch ti\u1ebfp c\u1eadn m\u1eb7c \u0111\u1ecbnh c\u1ee7a nhi\u1ec1u t\u1ed5 ch\u1ee9c l\u00e0 g\u1eedi m\u1ecdi th\u1ee9 v\u00e0o SIEM\u2014\u0111\u1ec3 “ph\u00f2ng h\u1edd”. Nh\u01b0ng chi\u1ebfn l\u01b0\u1ee3c ki\u1ec3u shortgun n\u00e0y d\u1eabn \u0111\u1ebfn:<\/p>\n

    \n
  • \n

    Chi ph\u00ed thu th\u1eadp d\u1eef li\u1ec7u cao<\/p>\n<\/li>\n

  • \n

    T\u1ef7 l\u1ec7 t\u00edn hi\u1ec7u tr\u00ean nhi\u1ec5u th\u1ea5p<\/p>\n<\/li>\n

  • \n

    C\u00e1c log d\u01b0 th\u1eeba v\u00e0 kh\u00f4ng li\u00ean quan l\u00e0m t\u1eafc ngh\u1ebdn h\u1ec7 th\u1ed1ng<\/p>\n<\/li>\n<\/ul>\n

    Cu\u1ed1i c\u00f9ng, \u0111i\u1ec1u n\u00e0y l\u00e0m gi\u1ea3m hi\u1ec7u qu\u1ea3 c\u1ee7a nh\u00f3m b\u1ea3o m\u1eadt v\u00e0 \u0111\u1ea9y chi ph\u00ed t\u0103ng cao.<\/p>\n

    Thay v\u00e0o \u0111\u00f3, h\u00e3y t\u1eadp trung v\u00e0o ch\u1ea5t l\u01b0\u1ee3ng h\u01a1n s\u1ed1 l\u01b0\u1ee3ng<\/strong>.
    Ch\u00eca kh\u00f3a n\u1eb1m \u1edf vi\u1ec7c x\u1eed l\u00fd d\u1eef li\u1ec7u tr\u01b0\u1edbc khi n\u00f3 \u0111\u01b0\u1ee3c g\u1eedi v\u00e0o SIEM<\/strong>, t\u1ee9c l\u00e0 ngay trong pipeline d\u1eef li\u1ec7u<\/strong>\u2014n\u01a1i qu\u1ea3n l\u00fd s\u1ebd r\u1ebb h\u01a1n v\u00e0 hi\u1ec7u qu\u1ea3 h\u01a1n nhi\u1ec1u.<\/p>\n

    <\/h2>\n

    B\u1ea1n c\u1ea7n g\u00ec \u0111\u1ec3 gi\u1ea3m kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u SIEM<\/strong><\/h2>\n

    Gi\u1ea3m kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u kh\u00f4ng ch\u1ec9 \u0111\u01a1n gi\u1ea3n l\u00e0 “c\u1eaft b\u1edbt ph\u1ea7n th\u1eeba”\u2014m\u00e0 \u0111\u00f2i h\u1ecfi ph\u1ea3i c\u00f3 c\u00f4ng c\u1ee5 ph\u00f9 h\u1ee3p v\u00e0 hi\u1ec3u bi\u1ebft \u0111\u00fang \u0111\u1eafn:<\/p>\n

      \n
    • \n

      C\u00f4ng c\u1ee5:<\/strong> S\u1eed d\u1ee5ng c\u00e1c b\u1ed9 thu th\u1eadp ho\u1eb7c t\u1ed5ng h\u1ee3p d\u1eef li\u1ec7u cho ph\u00e9p l\u1ecdc, ph\u00e2n t\u00edch c\u00fa ph\u00e1p (parsing) v\u00e0 t\u00f9y ch\u1ec9nh \u0111\u1ecbnh d\u1ea1ng log tr\u01b0\u1edbc khi \u0111\u01b0a v\u00e0o SIEM.<\/p>\n<\/li>\n

    • \n

      Ki\u1ebfn th\u1ee9c:<\/strong> Hi\u1ec3u r\u00f5 c\u00e1c ngu\u1ed3n log c\u1ee7a b\u1ea1n. X\u00e1c \u0111\u1ecbnh \u0111\u00e2u l\u00e0 d\u1eef li\u1ec7u gi\u00e1 tr\u1ecb v\u00e0 \u0111\u00e2u l\u00e0 kh\u00f4ng.<\/p>\n<\/li>\n

    • \n

      V\u00f2ng ph\u1ea3n h\u1ed3i:<\/strong> Theo d\u00f5i t\u00e1c \u0111\u1ed9ng c\u1ee7a vi\u1ec7c c\u1eaft gi\u1ea3m d\u1eef li\u1ec7u\u2014kh\u00f4ng ch\u1ec9 qua h\u00f3a \u0111\u01a1n SIEM, m\u00e0 c\u00f2n th\u00f4ng qua c\u00e1c ch\u1ec9 s\u1ed1 th\u1eddi gian th\u1ef1c.<\/p>\n<\/li>\n<\/ul>\n

      <\/h2>\n

      4 Nh\u1eefng m\u1eb9o hi\u1ec7u qu\u1ea3 \u0111\u00e3 \u0111\u01b0\u1ee3c ki\u1ec3m ch\u1ee9ng \u0111\u1ec3 gi\u1ea3m kh\u1ed1i l\u01b0\u1ee3ng d\u1eef li\u1ec7u SIEM<\/strong><\/h2>\n

      1. Ch\u1ec9 g\u1eedi nh\u1eefng g\u00ec SIEM c\u1ea7n<\/strong><\/h3>\n

      Nhi\u1ec1u log ch\u1ee9a metadata m\u00e0 SIEM c\u1ee7a b\u1ea1n \u0111\u00e3 x\u1eed l\u00fd ri\u00eang bi\u1ec7t. V\u00ed d\u1ee5, ph\u1ea7n header c\u1ee7a syslog (nh\u01b0 d\u1ea5u th\u1eddi gian v\u00e0 t\u00ean m\u00e1y ch\u1ee7) th\u01b0\u1eddng kh\u00f4ng c\u1ea7n thi\u1ebft trong n\u1ed9i dung ch\u00ednh c\u1ee7a log.<\/p>\n

      Vi\u1ec7c lo\u1ea1i b\u1ecf nh\u1eefng ph\u1ea7n n\u00e0y c\u00f3 th\u1ec3 gi\u00fap gi\u1ea3m 10% ho\u1eb7c h\u01a1n<\/strong> \u0111\u1ed1i v\u1edbi c\u00e1c log ng\u1eafn, c\u00f3 t\u1ea7n su\u1ea5t cao\u2014nh\u01b0 t\u1eeb t\u01b0\u1eddng l\u1eeda v\u00e0 thi\u1ebft b\u1ecb m\u1ea1ng\u2014m\u00e0 g\u1ea7n nh\u01b0 kh\u00f4ng t\u1ed1n nhi\u1ec1u c\u00f4ng s\u1ee9c<\/strong>.<\/p>\n

      2. Lo\u1ea1i b\u1ecf d\u1eef li\u1ec7u log t\u01b0\u1eddng l\u1eeda d\u01b0 h\u1eeba<\/strong><\/h3>\n

      L\u1ea5y log t\u1eeb t\u01b0\u1eddng l\u1eeda Palo Alto l\u00e0m v\u00ed d\u1ee5. Ch\u00fang th\u01b0\u1eddng bao g\u1ed3m:<\/p>\n