Re: SIEM Solution Recommendation

[Mike Lococo <mike.lococo () NYU EDU>]

On 10/26/2011 05:31 PM, David Escalante wrote:
> It depends upon what you're getting them for.  I don't view them as
> interchangeable solutions, and they cost a lot of money, plus the
> monitoring one does once they're installed.  Can you share more
> detailed requirements as to what the SIEM is expected to do, how big
> an environment it has to scale to, what number of FTEs you intend to
> have tend it once installed, etc...?

I'll agree with the sentiment that asking for a generic SIEM 
recommendation isn't going to get you very good advice.  It's important 
to talk about your specific goals. Are you driven by compliance 
requirements, by a need for a better incident detection/response 
console, or something else? Your use-cases both affect what products 
will work well for you, and also whose advice will be relevant for you.

- As a start, search around for the Gartner magic quadrant for SIEM,
  it's a reasonable place to get your feet wet.
- For peer input, I'd try to get some folks on the phone who you
  know have similar use-cases and see what they're doing.  I've found
  the interactivity of a phone conversation to be critical in getting
  to the point where I understand what someone is saying about their
  SIEM.

There really isn't a body of best-practice knowledge yet, and in order 
to give/get sensible advice on a mailing list you end up needing to 
write a tome covering your goals, your data-sources, your project 
timeline, your technical team's skills, and your budget.  Folks don't 
have the time, and are often hesitant to share all that info on a public 
list so you end up getting this misleading comment with no context.  I 
know that issue isn't unique to this topic, but I've found it much more 
significant for SIEM projects.  You really need to be willing to spend 
30 minutes learning about a site and their context before they can teach 
you anything about their SIEM project in a way that you'll be able to 
apply at your own site.

Cheers,
Mike Lococo