Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Each person in the company has a unique username/password, and nobody should log in with his username/password but him.

I want a program that would inspect the logs that includes a list of all the people that came to work today, and inspect the list of the logged in users (from the AD or wherever is), to find if there is someone in the logged-in logs that shouldn't be there (since he isn't in the first log). If the program finds that kind of inconsistency it should report immediately to the men in charge of the system.

The above manifest is what my boss wants, and he thinks that a SIEM system could give us that ability. That is just one example of log file cross-referencing that he wants us to have the ability to do.

Right now we have many systems (from many companies), and each one is inspecting different aspects of the company (for example, a system that give us reports from the file servers on what and whom has changed files, how much files, and any abnormality that it found; a system that checks USB insertion on PCs and so on). I would like to find a system that I can feed all of the reports to so that I can generate a cross-reference report.

As far as I have understand from the Wikipedia pages on SIEM (SIM, SEM), this system should give us that ability.

My question is, since I need to select one of the 86 different SIEM systems that are out there, and finally implement it at the organisation, I would like your advice on what is the the system that would fit to my above needs. It should also be easy to work with as much as possible, since at the end of the day someone will have to work with that system and if it doesn't have a meaningful interface and meaningful reports for example I wouldn't get the results I want.

In addition to the above, I would like to know what components I should be prepared for (computer client agent, server agents and so on).

share|improve this question

4 Answers 4

up vote 5 down vote accepted

Solely from the information in your question, narrowing down that list of 86 is not going to be easy - I had a quick flick through as I know a fair few of the top names. Some points:

  • SIEM solutions should all be able to run log correlation type activities
  • Most include device insertion logging and Tripwire type checks (or can incorpoprate Tripwire or any other SYSLOG logs)
  • Most of them have reasonable user interfaces
  • Most have scriptable command line interfaces

What you should do is list out the things you do want/need it to have and select on those items. If you can get it down to under ten you have a much better chance of being able to run comparison tests.

share|improve this answer
2  
Also having a general price point is going to help a lot. I've had some experience with the NitroSecurity SIEM and it worked well for our company. However if you are on a tighter budget, you may want to use some sort of combination of the free version of Splunk, OSSEC, OSSIM, etc. Software such as OSSEC has the built in HIDS, can send logs to a central location, and also does integrity checking. If you get the logs in a central location, the possibilities are limitless as Rory explained with scripting and some command line kung fu. –  Eric Dec 12 '11 at 16:41
    
nice list. what you would like to have are some kind of free definable Agents that can alert you: if this kind of alert occures > 5 times in X seconds timeframe -> send me a mail/textmessage. or: tell me whwenever sudo is used on any of my servers. Splunk does this –  that guy from over there Sep 12 '13 at 11:44

I personally use Splunk for this very thing. It is free up to 500MB of logs parsed daily, and has a robust search/correlation/dashboard functionality. Plus, it can run Python scripts natively so that you can generate your own data from custom sources.

For example, comparing a list of who is supposed to be working with the list of logged in users would be a trivial search. With the paid version, you could even have a manager's login so that they could see the reports for themselves.

Splunk is simply very powerful and helpful for me. It reduced 45 minutes of manual checks of various logs, reports, emails, etc down to an automatically generated email in pdf form.

Check it out.

share|improve this answer
    
500 MB isnt much if you want to analyze webbased logs. additionally, if your face soem kinds of attacks and come over that limit for more than 5/7 days, your splunk will stop working COMPLETELY. it does not just throw events like it does for the first days, it disables your instance completely. i did not excpected that. –  that guy from over there Sep 12 '13 at 11:48

+1 for schroeder's splunk suggestion.

It has quite an exotic learning curve, with basic searches availabe in literally minutes, then it took me a day to understand how to build a complex search. Two more days to have a set of charts (limelines, breakdowns, gauges). I then realized that it makes more sense to create saved searches and work from thre (you can edit them more easily).

I would also suggest looking at the config files (transforms.conf in particular).

The 500 MB quota can be worked around by preparing data to be fed to splunk. The enterprise (paying) version, however, adds many useful configuration items (notably a connection to your authentication system)

share|improve this answer

Since I am in SIEM business for 5 years I will make few statements hold up for me so far. In most cases SIEM is a political decision in company because company has some budget and wants to raise it's security awareness. Usually it comes to buying expensive product and then in the end neglecting it. So what I would look for in SIEM is options to extend it to fit your own needs as each company has it's own set of rules and security guidelines it must / wants to follow. With that in mind, to get most of SIEM you need:

  • open API

  • option to write your indexers

  • option to write custom reports

If you have sysadmins that don't want to invest too much time in it you will also need:

  • regular updates for security rules and indexers

Anyways, I don't know if what I am doing is fair because I am suggesting OTUS SIEM as our own product on which we spent 4 years so far but so far we got ton of user experience and we know with which expectations they start and what they settle with in the end.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.