Re: SIEM Tools

[Frank Barton <bartonf () HUSSON EDU>]

We recently implemented splunk, and we love it!

Frank

On Mon, Jan 22, 2018 at 7:05 AM, Seth A. Shestack <shestack () temple edu>
wrote:

> WE are currently using LogRhythm and are extremely happy.
>
> We also did a POC of Splunk which seemed very good, however we felt that
> Splunk would require a larger team to manage since it required more
> programming and LogRhythm had many of these correlation rules built out of
> the box.
>
>
>
> A further caution, I am not sure of your log volume but we started with a
> smaller system (Trigeo which was bought out by Solarwinds) and found that
> we outgrew it because it couldn’t scale.
>
> Make sure whatever system you buy will scale to any future needs.
>
>
>
> Seth
>
>
>
> *From:* The EDUCAUSE Security Constituent Group Listserv [mailto:
> SECURITY () LISTSERV EDUCAUSE EDU] *On Behalf Of *David D Grisham
> *Sent:* Saturday, January 20, 2018 11:31 AM
>
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* Re: [SECURITY] SIEM Tools
>
>
>
> We are using Splunk and it is a very versatile tool.
>
> Cheers.-grish *David Grisham*
>
> David Grisham, PhD, CISM, CRISC
>
> 933 Bradbury Drive SE, Suite 3131
>
> Manager, Cybersecurity, UNM Hospitals, UNM Health Science Center
>
> 505.272.5657 <(505)%20272-5657> my email Dgrisham () salud UNM edu
>
> DO NOT provide your username, password, or any personal information in
> any email.
>
> UNMH WILL NEVER ask you for your username or password via email.
>
> DO NOT CLICK links or attachments unless you are positive the content is
> safe.
>
>
>
>
>
>
>
> *From:* The EDUCAUSE Security Constituent Group Listserv [
> mailto:SECURITY () LISTSERV EDUCAUSE EDU <SECURITY () LISTSERV EDUCAUSE EDU>] *On
> Behalf Of *WALTER KERNER
> *Sent:* Friday, January 19, 2018 10:01 PM
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* Re: [SECURITY] SIEM Tools
>
>
>
> Hi Michael. We have had good luck with Alert Logic. It combines log
> analysis and IDS functions and has been very valuable.
>
>
>
> On Fri, Jan 19, 2018 at 9:48 PM Madl, Michael <michael.madl () indwes edu>
> wrote:
>
> I am currently reviewing several SIEM products [QRadar, Alien Vault, Log
> Rhythm etc.].
>
>
>
> Can anyone share any success stories with the product they are utilizing.
> I have utilized Alien Vault in the past and the correlation functionality
> is pretty good.  Threat detection is also done well.
>
>
>
> Gartner has been a great tool for review but wondering if anyone had any
> strong feelings/experiences with certain tools.
>
>
>
>
>
> Thank you in advance,
>
>
>
>
>
> MICHAEL MADL
>
> INFORMATION SECURITY OFFICER
>
> UNIVERSITY INFORMATION TECHNOLOGY
>
>
>
> INDIANA WESLEYAN UNIVERSITY
>
> 4201 SOUTH WASHINGTON STREET
> <https://maps.google.com/?q=4201+SOUTH+WASHINGTON+STREET%0D+MARION,+IN+46953%0D+%C2%A0%0D+765&entry=gmail&source=g>
>
> MARION, IN 46953
> <https://maps.google.com/?q=4201+SOUTH+WASHINGTON+STREET%0D+MARION,+IN+46953%0D+%C2%A0%0D+765&entry=gmail&source=g>
>
>
>
> 765
> <https://maps.google.com/?q=4201+SOUTH+WASHINGTON+STREET%0D+MARION,+IN+46953%0D+%C2%A0%0D+765&entry=gmail&source=g>
> .677.2688   |   765.677.2020 <(765)%20677-2020> FAX
>
> michael.madl () indwes edu <mike.madl () indwes edu>
>
>
>
> INDWES.EDU/IT <http://indwes.edu/IT>
>
>
>
> [image: cid:image001.jpg@01D3436E.D1E0F1C0]
>
>
>
> *CONFIDENTIALITY NOTICE:* *This email, including applicable attachments,
> may include legally protected information.  If you are not the intended
> recipient of this message, you may not disclose, print, copy, save, or
> disseminate this information. If you have received this email in error,
> please notify the sender by replying to this message and immediately delete
> this message.*
>
>
>
>
>
> --
>
> Walter Kerner
> AVP and CISO
> Fashion Institute of Technology



-- 
Frank Barton
Security+, ACMT
IT Systems Administrator
Husson University