Re: SIEM Tools

[Chad Tracy <chad.tracy () COLBY EDU>]

We are a very small shop and required a tool that would not take a lot of
time to tune and work with. We transitioned from QRadar to SumoLogic.

Chad Tracy
Director of Information Security
Colby College
Waterville, ME 04901
207 . 859 . 4199
chad.tracy () colby edu

On Sat, Jan 20, 2018 at 11:32 AM, David D Grisham <DGrisham () salud unm edu>
wrote:

> Also, there's a lot of good information about planning your SOC and
> gathering information from SANS SIM course. Cheers.-grish
>
>
>
> *From:* The EDUCAUSE Security Constituent Group Listserv [mailto:
> SECURITY () LISTSERV EDUCAUSE EDU] *On Behalf Of *Madl, Michael
> *Sent:* Friday, January 19, 2018 7:49 PM
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* [SECURITY] SIEM Tools
>
>
>
> I am currently reviewing several SIEM products [QRadar, Alien Vault, Log
> Rhythm etc.].
>
>
>
> Can anyone share any success stories with the product they are utilizing.
> I have utilized Alien Vault in the past and the correlation functionality
> is pretty good.  Threat detection is also done well.
>
>
>
> Gartner has been a great tool for review but wondering if anyone had any
> strong feelings/experiences with certain tools.
>
>
>
>
>
> Thank you in advance,
>
>
>
>
>
> MICHAEL MADL
>
> INFORMATION SECURITY OFFICER
>
> UNIVERSITY INFORMATION TECHNOLOGY
>
>
>
> INDIANA WESLEYAN UNIVERSITY
>
> 4201 SOUTH WASHINGTON STREET
> <https://maps.google.com/?q=4201+SOUTH+WASHINGTON+STREET%0D+MARION,+IN+46953%0D+%C2%A0%0D+765&entry=gmail&source=g>
>
> MARION, IN 46953
> <https://maps.google.com/?q=4201+SOUTH+WASHINGTON+STREET%0D+MARION,+IN+46953%0D+%C2%A0%0D+765&entry=gmail&source=g>
>
>
>
> 765.677.2688 <(765)%20677-2688>   |   765.677.2020 <(765)%20677-2020> FAX
>
> michael.madl () indwes edu <mike.madl () indwes edu>
>
>
>
> INDWES.EDU/IT <http://indwes.edu/IT>
>
>
>
> [image: cid:image001.jpg@01D3436E.D1E0F1C0]
>
>
>
> *CONFIDENTIALITY NOTICE:* *This email, including applicable attachments,
> may include legally protected information.  If you are not the intended
> recipient of this message, you may not disclose, print, copy, save, or
> disseminate this information. If you have received this email in error,
> please notify the sender by replying to this message and immediately delete
> this message.*