Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering whether we can use logstash or any other open source or free log management tool to collect and index the data and then feed this index into RSA envision or any other enterprise SIEM tool.

Will this be beneficial in any way?

Also are the indexes of various Log Management and SIEM tools -- (Splunk, RSA envision, HP Arcsight Logger, Logstash etc.) compatible with each other?

My organization is planning to buy RSA envision appliance and is there any way to restrict or select only certain types of log files (eg: security logs or Apache logs) so that only those are monitored and this will reduce the EPS (events per second)?

share|improve this question

1 Answer 1

Indexes are specific to the SIEM tools depends upon the DB they are using in the back end and the database schema system they use. So, the indexes cant be compatible each other. The point to be considered is whether this index can be customized based on the customer needs or not? or will the SIEM allows indexing multiple fields (Ex: username, source IP, dest IP etc)

All the SIEMs are providing the way to select only required log types.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.