Re: [External] Re: [SECURITY] SIEM questions.

[Kevin Wilcox <wilcoxkm () APPSTATE EDU>]

I'm going to tack on to what Nadim said. I may be a "pure Elastic" fan but
for most small shops, I think Graylog is the way to go. It gives you as
much storage as you can put behind it (it's elasticsearch for storage under
the hood for indexing), you can feed it with logstash so you can do all
your parsing (schema on write) and enrichment up-front, it supports parsing
at search (schema on read) and it has an excellent support community (in
addition to paid support, if you go that route).

That doesn't mean I'm not going to say, "you should also look at the
Elastic Stack" =) The biggie for me is the enrichment up-front. We get an
MFA log, we pull the user name and IP, then we add data from Active
Directory, we add data from inventory, we add GeoIP data (really just after
ASN / company info), then we store the log event with that data added. It
makes, e.g., doing a search like "give me all the MFA events for this
department that weren't from a local internet provider" really quick and
easy - it isn't having to crawl through and find all the usernames for that
department AND do GeoIP at search time, it's just filtering on data that's
already there. "show me when someone from x departments has a login event
from a *new* Internet provider" -- super simple, it's just looking for a
new value to appear in the geoip ASN field. You do need to know your log
data for it to be effective...

kmw

On Thu, May 13, 2021 at 7:44 PM Nadim El-Khoury <
0000024d485fe2c4-dmarc-request () listserv educause edu> wrote:

> Hi Jonathan,
>
> We use Graylog here at Springfield College. We are using the open-source
> version, and we are so far happy with it.
> We started using it a couple of months ago, and so far, we indexed around
> 103+ GB of data from our Palo Alto firewalls alone. We did not even count
> the data from the ASA VPN devices and other systems.
> As a small college with limited funds and resources, we would not be able
> to afford the other products.
>
> Best,
>
> Nadim El-Khoury
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
> Springfield College
> 263 Alden Street
> Springfield, MA 01109
> nel-khoury () springfield edu
>
>
> On Thu, May 13, 2021 at 4:15 PM Francisco Chavez <fac3 () stmarys-ca edu>
> wrote:
>
> > Hi Kimmitt,
> >
> > Here at Saint Mary’s we use AlienVault. Like Rich mentioned, the company
> > has had a few bad years but the product and support is much better now. We
> > currently use AlienVault USM Anywhere which is hosted on AWS.
> >
> > Please feel free to reach out directly if you have any questions!
> >
> > Sincerely,
> > Francisco Chavez
> >
> >
> > --
> > Francisco Chavez, MBA  | Interim CTO
> > Saint Mary's College of California
> >
> > ...............................................................................................................................
> > IT Services <https://www.stmarys-ca.edu/it-services>
> > phone: (925) 631-8236
> > email: fac3 () stmarys-ca edu
> >
> >
> >
> > On May 13, 2021, at 11:32 AM, Kimmitt, Jonathan <
> > jonathan-kimmitt () UTULSA EDU> wrote:
> >
> > Reposting from the CIO group email for my CIO:
> >
> > Happy Thursday,
> >
> > Smaller institutions with pandemic-minded budgets, do you have a SIEM
> > you’re using that is quality, provides insightful reporting and is either
> > easy to manage OR managed externally? That you would recommend? (I’ll take
> > warnings too!)
> >
> > We’re looking to make a change within the next 12-18 months and I could
> > use honest feedback on solutions, experience, cost, dedicated headcount
> > support. Can email me directly:
> >
> > Thanks much,
> >
> >
> > -Jonathan
> >
> >
> >
> > ~
> > Jonathan Kimmitt
> > CISSP, FIP, CDPSE, CIPP/E, CIPM, CIPT,
> > OTCP,GLEG, GPEN, GSNA, PCIP, CEH
> > Chief Information Security Officer
> > Information Technology
> > The University of Tulsa
> > 918.631.2743
> >
> >
> > **********
> > Replies to EDUCAUSE Community Group emails are sent to the entire
> > community list. If you want to reply only to the person who sent the
> > message, copy and paste their email address and forward the email reply.
> > Additional participation and subscription information can be found at
> > https://www.educause.edu/community
> >
> >
> > **********
> > Replies to EDUCAUSE Community Group emails are sent to the entire
> > community list. If you want to reply only to the person who sent the
> > message, copy and paste their email address and forward the email reply.
> > Additional participation and subscription information can be found at
> > https://www.educause.edu/community
> **********
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community