RE: SIM Tools, and endpoint security.

["Eric Hines" <eric.hines () appliedwatch com>]

**** I represent the vendor ****

Kevin,

You might also take a look at Applied Watch. If you are using any open
source applications as well, we focus on correlation with open source and
commercial solutions. In addition, most of the SIM products you'll find out
there, simply provide log aggregation and monitoring. The Applied Watch
Command Center offers a management policy editor for virtually every device
we add support for.

Currently, we support Snort, Snort-Inline, Nessus, Syslog/Syslog-NG, LaBrea
Tarpit, Cisco, and Microsoft Windows logs.



Best Regards,

Eric Hines, GCIA, CISSP
CEO, President, Chairman
Applied Watch Technologies, LLC
1134 N. Main St.
Algonquin, IL 60102
Tel: (877) 262-7593 e:327
Fax: (877) 262-7593
Mob: (847) 456-6785
Web: http://www.appliedwatch.com
----------------------------------------------------------------------------
-
Enterprise Snort Management at http://www.appliedwatch.com.
Security Information Management for the Open Source Enterprise.
----------------------------------------------------------------------------
-


-----Original Message-----
From: KJP [mailto:kjp011975 () gmail com]
Sent: Friday, April 22, 2005 6:18 AM
To: focus-ids () securityfocus com
Subject: SIM Tools, and endpoint security.

I am looking to get some information and some input on SIM Tools.

Currently we have looked at the Protego (now Cisco) Mars product as well at
NetForensics.

We are looking to such a tool to fill the gaps in the Host Intrusion from a
syslog type perspective to complement our Network Intrusion plan.  We would
dump OS logs, app logs, fw logs, router and switch logs to the SIM and would
like to retain logs for an extended period.

Looking for feedback on SIMs.

Another area we are looking in is for Endpoint security and policy
enforcement.  We are currently looking at Cisco CSA.  Who else should we
look at and any feedback on CSA or other products?

Thanks,

Kevin Phillips

--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion
detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------



--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------