The siem tag has no wiki summary.
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
15
votes
3answers
840 views
What techniques and tools do you use to relate security events?
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck.
Do you have any cool ...
10
votes
3answers
376 views
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.
Rich posted these follow-up tweets:
And by APT I mean real ...
7
votes
3answers
577 views
SIEM system, what are the benefits?
Each person in the company has a unique username/password, and nobody should log in with his username/password but him.
I want a program that would inspect the logs that includes a list of all the ...
6
votes
1answer
883 views
Security Operation Center (SOC)
I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
5
votes
2answers
207 views
Enterprise security incident response and detection
I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different ...
4
votes
2answers
286 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
3
votes
2answers
340 views
Security logs on Linux, Solaris and Windows
As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
3
votes
2answers
523 views
SIEM and Windows Event Logs
When considering what Windows event logs to incorporate into a SIEM solution, should I be looking at just the Security event logs, or all categories of event log? How useful are the other categories ...
3
votes
1answer
157 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
2
votes
2answers
82 views
When would you support the storage of Security & Application event logs in the Cloud?
Under what conditions would you be comfortable storing server log data residing in a secure facility, off-premises?
When would you consider a SaaS /hosted solution and what value add should that ...
1
vote
2answers
2k views
How to connect sensors to AlienVault?
I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
1
vote
0answers
66 views
What becomes of SIEM when a large database like teradata gets involved? [closed]
My topic sentence says it all.
I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
1
vote
0answers
438 views
SIEM-AlienVault; Risk Metrics, Assets, and basics [closed]
Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.
I've gone through 2 installs so far.
First time messing with SIEM, though have very limited ...
0
votes
1answer
83 views
Weird issue with Firewall blocking NATed packets
From my SIEM I am seeing that a (we don't own the FW) Cisco ASA is blocking packets destined for the internal network (post NAT), here's what I'm seeing (IP addresses are faked due to security)
...
0
votes
1answer
91 views
SIEM technology is it database friendly? [closed]
I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
0
votes
2answers
204 views
is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?
Anyone have experience in a solution to manage in an integrated view this functionality ?
- network forensic
- SIEM
- intelligence analysis and investigation
Like Niksun or Solera solution do ?
I'm ...
