RE: SIM Tools, and endpoint security.

[John Kelly <idswizard () earthlink net>]

If you are looking at netForensics and Protego you may want to look at neuSECURE from GuardedNet.  The product was 
built with incident response in-mind (also does compliance monitoring today) and it has the ability to capture log, 
vulnerability, and asset data.  It can help weed through the data and prioritize the events/ incidents based on their 
severity and impact.  The workflow using the host investigation toolkit, event visuals and ticket system works very 
well together.

If you are a Cisco shop neuSECURE does a very good job of integrating with Cisco products.  GuardedNet does provide 
support for an extensive list of products.  

It also appears they are going to provide an appliance in the near future, which may help in reducing deployment and 
maintenance time (since you mentioned Protego).

For end-point security and policy enforcement you may want to look Sygate.

-----Original Message-----
From: KJP [mailto:kjp011975 () gmail com]
Sent: Friday, April 22, 2005 6:18 AM
To: focus-ids () securityfocus com
Subject: SIM Tools, and endpoint security.

I am looking to get some information and some input on SIM Tools.

Currently we have looked at the Protego (now Cisco) Mars product as well at
NetForensics.

We are looking to such a tool to fill the gaps in the Host Intrusion from a
syslog type perspective to complement our Network Intrusion plan.  We would
dump OS logs, app logs, fw logs, router and switch logs to the SIM and would
like to retain logs for an extended period.

Looking for feedback on SIMs.

Another area we are looking in is for Endpoint security and policy
enforcement.  We are currently looking at Cisco CSA.  Who else should we
look at and any feedback on CSA or other products?

Thanks,

Kevin Phillips

--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities,
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion
detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------



--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------



--------------------------------------------------------------------------
Stop hurting your network!
 
The NeVO passive vulnerability sensor continuously finds vulnerabilities, 
applications and new hosts without the need for network scanning. 
It also finds compromised systems with application-based intrusion detection. 
Go to http://www.tenablesecurity.com/products/nevo.shtml to learn more.
--------------------------------------------------------------------------