- This topic has 3 replies, 4 voices, and was last updated 11 years, 11 months ago by
timmedin.
-
AuthorPosts
-
-
September 24, 2008 at 1:50 pm #2869
scucci
ParticipantHello,
I’m currently in the market for a new SIEM and wanted to know what everyone recomends. I know that according to the SIEM it will be based on either Events Per Second (EPS) or Hosts. Right now I’m looking for a solid SIEM for a medium sized business. So far I’ve looked at (Q1 Labs, RSA, High Tower, Cisco, Trigeo, and ArcSight. I’m currently running one from eIQ networks that I’m looking to have replaced when the support contract is complete. Any suggestions or advice?
Scucci
-
September 24, 2008 at 3:53 pm #19922
oleDB
ParticipantI personally did not like Q1 for the simple fact that it doesn’t track by hostname. So essentially everything is IP based and stateless. So you can’t add notes to a host so when the event reoccurs other analysts will not see the work you already did. Yes you can whitelist events so that they don’t reoccur, but there was also a bug with that as well, where everything gets whitelisted. I also didn’t think the product was capable of keeping up with the amount logs generated in a large business, but you might have better luck in a medium sized one.
If I had my choice I would go with Arcsight, which is not without issues either. But in my experience with 3 different products it was the best. -
October 19, 2008 at 7:45 pm #19923
Salvalagio
ParticipantI worked w/ Novell’s Sentinel. It’s a great tool, very fast interface and you can set commom commands you migth use during your workday, but it’s very hard to get it up and running and also, you should have a specialized person to keep it running smooth.
Also, you have to learn a new rule syntax to get your things done. Yep. it is proprietary query language. This way you may loose something important if you are not very skilled in their querying language.
Another one you can use is IBM’s TSOM. It’s java, but it is fast. Cool Interface, easy to use, but it isn’t very pratical. All rules you can create are based in closed statements, so you can’t script your way out to get incidents.
You can set your prefered commands to be a right-click for from lyou, we are having some bug issues here, but afterall it’s a good SIEM.Rodrigo Salvalagio
-
February 14, 2009 at 8:12 pm #19924
timmedin
ParticipantI like Cisco Mars with the caveat that it works best if you are a Cisco shop.
-
-
AuthorPosts
- You must be logged in to reply to this topic.