The siem tag has no wiki summary.
138
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
0
votes
1answer
82 views
Weird issue with Firewall blocking NATed packets
From my SIEM I am seeing that a (we don't own the FW) Cisco ASA is blocking packets destined for the internal network (post NAT), here's what I'm seeing (IP addresses are faked due to security)
...
1
vote
2answers
2k views
How to connect sensors to AlienVault?
I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
1
vote
0answers
66 views
What becomes of SIEM when a large database like teradata gets involved? [closed]
My topic sentence says it all.
I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
3
votes
1answer
154 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
0
votes
1answer
90 views
SIEM technology is it database friendly? [closed]
I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
1
vote
0answers
434 views
SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited ...
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
7
votes
3answers
574 views
SIEM system, what are the benefits?
Each person in the company has a unique username/password, and nobody should log in with his username/password but him.
I want a program that would inspect the logs that includes a list of all the ...
3
votes
2answers
339 views
Security logs on Linux, Solaris and Windows
As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
3
votes
2answers
519 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
5
votes
2answers
206 views
Enterprise security incident response and detection
I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different ...
6
votes
1answer
877 views
Security Operation Center (SOC)
I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
10
votes
3answers
376 views
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.
Rich posted these follow-up tweets:
And by APT I mean real ...
15
votes
3answers
839 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
0
votes
2answers
203 views
is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?
Anyone have experience in a solution to manage in an integrated view this functionality ?
- network forensic
- SIEM
- intelligence analysis and investigation
Like Niksun or Solera solution do ?
I'm ...
2
votes
2answers
82 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
