Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking for some type of central management/correlation of my security/monitoring products. I use various open source and paid for products such as Nessus, Snort, OSSEC, Nagios, Cacti, etc. and it's a pain trying to correlate security events when they occur. I have looked into OSSIM a little bit and also PreludeIDS but haven't gotten to far into either one. I was wondering what everyone's opinion was. Thanks.

share|improve this question

2 Answers 2

What we have done is to consolidate all information into OSSEC (free and open source).

We push snort logs, syslog, Windows logs, apache logs and nmap scans to OSSEC, which will analyze, correlate (and in some cases, do active responses), in real time.

However, since OSSEC is more a command-line tool, with little graphical interface, we push all the alerts to Splunk (free) to make our management happy.

So I would say that OSSEC + Splunk is the best SIM you can have.. and yes, we tried multiple commercial SIM/SIEMs (Cisco Mars, netforensics, etc) but the correlation and capabilities of OSSEC are hard to beat. Plus, it is extremely lightweight and easy to set up.

share|improve this answer
    
I will definitely give it a try. I knew OSSEC could do Snort logs but haven't messed with that aspect of it yet. Thanks for the info. –  user15736 Aug 12 '09 at 18:15

Are you willing to spend money? If so, I was pretty happy with Arcsight when I was using it a few years ago. I imagine it has improved since then.

share|improve this answer
    
Just all depends on how good the product is and how much it costs. I will definitely look into Arcsight. Thank you. –  user15736 Aug 12 '09 at 18:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.