.

Preferred SIEM

<<

munch137

Newbie
Newbie

Posts: 7

Joined: Fri Feb 20, 2009 3:19 pm

Post Fri Aug 28, 2009 4:12 pm

Preferred SIEM

Looking at the 2009 Gartner "Magic Quadrant" report on SIEM and also the critical capabilities report, there are many leaders in the market. For small to mid-size organizations, what in your opinion are the best solutions to put on the "short list"?
MCSD, CISSP, OSCP - I just hacked your computer and ate all your cookies
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Sat Aug 29, 2009 8:32 pm

Re: Preferred SIEM

I am going through this process as well.  I am leaning towards Loglogic right now and have Cisco's MARS in my sights too.  The salesperson I am dealing with @ Loglogic has been painful to deal with.

What have you looked at so far?
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Sep 04, 2009 4:04 pm

Re: Preferred SIEM

After demoing the two products I like Loglogic the best.  We also demoed Cisco MARS and wasn't nearly as impressed as I was the Loglogic.  I recommend joining a Webex and seeing first hand and then deciding based upon your needs.  The various solutions out there that are good for one company may not be good for another.

Good luck and let me know what way you went.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Fri Sep 04, 2009 6:08 pm

Re: Preferred SIEM

Dengar13 wrote:After demoing the two products I like Loglogic the best.  We also demoed Cisco MARS and wasn't nearly as impressed as I was the Loglogic.



I use Cisco MARS at work, even have a few books on it at home, but have found the the web interface and the over all control of it kludgy. It was in place before I started, and it became mine shortly there after. It's better than nothing, but sometimes I wish it could do more. (or I knew how to make it sing and dance the way I want).
OSWP, Sec+
<<

timmedin

User avatar

Sr. Member
Sr. Member

Posts: 469

Joined: Thu Feb 05, 2009 11:18 pm

Post Mon Sep 07, 2009 12:21 am

Re: Preferred SIEM

I like MARS but we are Cisco shop so it works well. If it were a more heterogeneous shop then I'd push for something else. Relative to some of the others it has a pretty reasonable price tag.
twitter.com/timmedin | http://blog.securitywhole.com
<<

Bane

Post Thu Sep 10, 2009 11:35 pm

Re: Preferred SIEM

I have used a few SIM tools and it really comes down to what vendors/devices the SIEM supports, whether or not you like the interface, what size your company is, and how much work you are willing to do to build rules.

For small to midsize companies take a hard look at TriGeo and Hightower (acquired by NetForensics). For large companies there are several good options, such as Loglogic, Novell Sentinel, RSA, etc.

I agree with the statements made so far on Cisco MARS also. I personally would not bother with MARS unless you are a Cisco only shop. There is some third party support, but it is not significant and is also not updated very often.
<<

vekarman

User avatar

Newbie
Newbie

Posts: 28

Joined: Thu Mar 19, 2009 1:21 am

Post Thu Sep 17, 2009 4:54 am

Re: Preferred SIEM

If you have time to do research, try open source OSSIM.

Another good commercial product is CorrLog.
CISSP
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Sep 18, 2009 1:11 pm

Re: Preferred SIEM

Has anyone had any experience with RSA's enVision solution?  I see that it is in the upper-right quadrant as well with Gartner, but would like some opinions.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!
<<

Dengar13

User avatar

Sr. Member
Sr. Member

Posts: 380

Joined: Tue Sep 20, 2005 8:43 am

Location: The Steel City

Post Fri Oct 02, 2009 8:30 am

Re: Preferred SIEM

Well, after demoing and doing research I think I am leaning towards Q1 Labs' QRadar.  This is a really great product that perfectly meets our needs.  Excellent reporting and a lot easier to manage that Loglogic.
A+, Net+, MCP, CEH
MCSE: Security/Messaging
MCSA: Security/Messaging
Former U.S. Marine and damn proud of it!

Return to Other

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software