Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network

share|improve this question

1 Answer 1

Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network.

Sure, you can probably get away with forensic tools installed in an enterprise network. However, said tools are probably scattered all over the network.

For convenience sake, you will probably want to aggregate all the data and logs generated by the tools in one location. You will probably want to create a nice dashboard for glance-able information because who likes looking at logs?

You probably also don't want to hire a guy to stare at the logs all day in case something goes wrong. You probably want a way to alert your administrators in case something goes wrong....

At this point, you are basically rolling your own SIEM anyway so you might as well use one that has already been written and battle-tested.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.