Each person in the company has a unique username/password, and nobody should log in with his username/password but him.
I want a program that would inspect the logs that includes a list of all the people that came to work today, and inspect the list of the logged in users (from the AD or wherever is), to find if there is someone in the logged-in logs that shouldn't be there (since he isn't in the first log). If the program finds that kind of inconsistency it should report immediately to the men in charge of the system.
The above manifest is what my boss wants, and he thinks that a SIEM system could give us that ability. That is just one example of log file cross-referencing that he wants us to have the ability to do.
Right now we have many systems (from many companies), and each one is inspecting different aspects of the company (for example, a system that give us reports from the file servers on what and whom has changed files, how much files, and any abnormality that it found; a system that checks USB insertion on PCs and so on). I would like to find a system that I can feed all of the reports to so that I can generate a cross-reference report.
My question is, since I need to select one of the 86 different SIEM systems that are out there, and finally implement it at the organisation, I would like your advice on what is the the system that would fit to my above needs. It should also be easy to work with as much as possible, since at the end of the day someone will have to work with that system and if it doesn't have a meaningful interface and meaningful reports for example I wouldn't get the results I want.
In addition to the above, I would like to know what components I should be prepared for (computer client agent, server agents and so on).