I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM requirements.
The questions are:-
- How does SIEM grows with the use of database? I'm talking in terms of high volume storage comparable to the size of banks or large country census data.
- How well does SIEM integrate with database solutions such as InfoSphere Guardium?
- What basic functionality should a good SIEM have if it needs to support logs from a large database such as teradata?
- What kind of filtration, normalization and aggregation rules can be applied if logs are obtained from database solely ( with no middle-ware solution included)?
- Do you have knowledge of SIEM products that provide out of box functionality to entertain database logs?
- And lastly, how does a regular SIEM saves database logs?