I am looking for some type of central management/correlation of my security/monitoring products. I use various open source and paid for products such as Nessus, Snort, OSSEC, Nagios, Cacti, etc. and it's a pain trying to correlate security events when they occur. I have looked into OSSIM a little bit and also PreludeIDS but haven't gotten to far into either one. I was wondering what everyone's opinion was. Thanks.
|
feedback
|
|
What we have done is to consolidate all information into OSSEC (free and open source). We push snort logs, syslog, Windows logs, apache logs and nmap scans to OSSEC, which will analyze, correlate (and in some cases, do active responses), in real time. However, since OSSEC is more a command-line tool, with little graphical interface, we push all the alerts to Splunk (free) to make our management happy. So I would say that OSSEC + Splunk is the best SIM you can have.. and yes, we tried multiple commercial SIM/SIEMs (Cisco Mars, netforensics, etc) but the correlation and capabilities of OSSEC are hard to beat. Plus, it is extremely lightweight and easy to set up. | |||
feedback
|
|
Are you willing to spend money? If so, I was pretty happy with Arcsight when I was using it a few years ago. I imagine it has improved since then. | |||
feedback
|
