SIM Tools, and endpoint security.

[KJP <kjp011975 () gmail com>]

I am looking to get some information and some input on SIM Tools.

Currently we have looked at the Protego (now Cisco) Mars product as
well at NetForensics.

We are looking to such a tool to fill the gaps in the Host Intrusion
from a syslog type perspective to complement our Network Intrusion
plan.  We would dump OS logs, app logs, fw logs, router and switch
logs to the SIM and would like to retain logs for an extended period.

Looking for feedback on SIMs.

Another area we are looking in is for Endpoint security and policy
enforcement.  We are currently looking at Cisco CSA.  Who else should
we look at and any feedback on CSA or other products?

Thanks,

Kevin Phillips

--------------------------------------------------------------------------
Stop hurting your network!

The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning.
It also finds compromised systems with application-based intrusion detection.
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------