I was wondering whether we can use logstash or any other open source or free log management tool to collect and index the data and then feed this index into RSA envision or any other enterprise SIEM tool.
Will this be beneficial in any way?
Also are the indexes of various Log Management and SIEM tools -- (Splunk, RSA envision, HP Arcsight Logger, Logstash etc.) compatible with each other?
My organization is planning to buy RSA envision appliance and is there any way to restrict or select only certain types of log files (eg: security logs or Apache logs) so that only those are monitored and this will reduce the EPS (events per second)?