I just would like to have your feedback if you were involved with Security Information and Event Management.
From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)? It seems to be quite huge and expensive to set up this kind of software - SIEM (and team dealing with, SOC, ...). In the end, companies may be neglecting it. Are NIDS/HIDS not enough to ensure security monitoring?
According to me in most cases SIEM is a political decision (budget) over a real need.