Security Incident and Event Management (SIEM)

[scucci]

Hello,

I’m currently in the market for a new SIEM and wanted to know what everyone recomends. I know that according to the SIEM it will be based on either Events Per Second (EPS) or Hosts. Right now I’m looking for a solid SIEM for a medium sized business. So far I’ve looked at (Q1 Labs, RSA, High Tower, Cisco, Trigeo, and ArcSight. I’m currently running one from eIQ networks that I’m looking to have replaced when the support contract is complete. Any suggestions or advice?

Scucci

[oleDB]

I personally did not like Q1 for the simple fact that it doesn’t track by hostname. So essentially everything is IP based and stateless. So you can’t add notes to a host so when the event reoccurs other analysts will not see the work you already did. Yes you can whitelist events so that they don’t reoccur, but there was also a bug with that as well, where everything gets whitelisted. I also didn’t think the product was capable of keeping up with the amount logs generated in a large business, but you might have better luck in a medium sized one.
If I had my choice I would go with Arcsight, which is not without issues either. But in my experience with 3 different products it was the best.

[Salvalagio]

I worked w/ Novell’s Sentinel. It’s a great tool, very fast interface and you can set commom commands you migth use during your workday, but it’s very hard to get it up and running and also, you should have a specialized person to keep it running smooth.
Also, you have to learn a new rule syntax to get your things done. Yep. it is proprietary query language. This way you may loose something important if you are not very skilled in their querying language.
Another one you can use is IBM’s TSOM. It’s java, but it is fast. Cool Interface, easy to use, but it isn’t very pratical. All rules you can create are based in closed statements, so you can’t script your way out to get incidents.
You can set your prefered commands to be a right-click for from lyou, we are having some bug issues here, but afterall it’s a good SIEM.

Rodrigo Salvalagio

[timmedin]

I like Cisco Mars with the caveat that it works best if you are a Cisco shop.

[Author]

Posts