exaProtect

[forest.robert () gmail com]

I work for an MSSP, and we are currently looking at expanding our Managed IDS offering. As part of this we are looking 
for a product that will collect and aggregate events from a large number of heterogenous event sources (if truly event 
generator agnostic, then even better) (both network and host sensors). In short, (some of) our requirements are that it 
can collect events, standardise their format and allow us to apply filtering *after* event collection (so it would 
necessarily have to support high volumes of data).

After collection, events need to be stored securely, and displayed to analysts in as good a way as possible (I am sure 
we all have our preferences here - I am partial to Sguil/Sguil-like displays).

Now - to my question. We have looked at exaProtect, and it seems like a solid product which meets a majority of our 
requirements. I was wondering if anyone on the list have any experiences / opinions on exaProtect that they would like 
to share?

Thanks in advance.

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------