.

Security Incident and Event Management (SIEM)

<<

scucci

Newbie
Newbie

Posts: 29

Joined: Mon Sep 15, 2008 10:55 am

Post Wed Sep 24, 2008 8:50 am

Security Incident and Event Management (SIEM)

Hello,

I'm currently in the market for a new SIEM and wanted to know what everyone recomends. I know that according to the SIEM it will be based on either Events Per Second (EPS) or Hosts. Right now I'm looking for a solid SIEM for a medium sized business. So far I've looked at (Q1 Labs, RSA, High Tower, Cisco, Trigeo, and ArcSight. I'm currently running one from eIQ networks that I'm looking to have replaced when the support contract is complete. Any suggestions or advice?

Scucci
<<

oleDB

User avatar

Recruiters
Recruiters

Posts: 236

Joined: Thu Jul 20, 2006 8:58 am

Location: HOA

Post Wed Sep 24, 2008 10:53 am

Re: Security Incident and Event Management (SIEM)

I personally did not like Q1 for the simple fact that it doesn't track by hostname. So essentially everything is IP based and stateless. So you can't add notes to a host so when the event reoccurs other analysts will not see the work you already did. Yes you can whitelist events so that they don't reoccur, but there was also a bug with that as well, where everything gets whitelisted. I also didn't think the product was capable of keeping up with the amount logs generated in a large business, but you might have better luck in a medium sized one.
If I had my choice I would go with Arcsight, which is not without issues either. But in my experience with 3 different products it was the best.
<<

Salvalagio

Newbie
Newbie

Posts: 4

Joined: Sun Oct 19, 2008 2:15 pm

Post Sun Oct 19, 2008 2:45 pm

Re: Security Incident and Event Management (SIEM)

I worked w/ Novell's Sentinel. It's a great tool, very fast interface and you can set commom commands you migth use during your workday, but it's very hard to get it up and running and also, you should have a specialized person to keep it running smooth.
Also, you have to learn a new rule syntax to get your things done. Yep. it is proprietary query language. This way you may loose something important if you are not very skilled in their querying language.
Another one you can use is IBM's TSOM. It's java, but it is fast. Cool Interface, easy to use, but it isn't very pratical. All rules you can create are based in closed statements, so you can't script your way out to get incidents.
You can set your prefered commands to be a right-click for from lyou, we are having some bug issues here, but afterall it's a good SIEM.

Rodrigo Salvalagio
<<

timmedin

User avatar

Sr. Member
Sr. Member

Posts: 469

Joined: Thu Feb 05, 2009 11:18 pm

Post Sat Feb 14, 2009 3:12 pm

Re: Security Incident and Event Management (SIEM)

I like Cisco Mars with the caveat that it works best if you are a Cisco shop.
twitter.com/timmedin | http://blog.securitywhole.com

Return to Incident Response

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software