0

I just would like to have your feedback if you were involved with Security Information and Event Management.

From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)? It seems to be quite huge and expensive to set up this kind of software - SIEM (and team dealing with, SOC, ...). In the end, companies may be neglecting it. Are NIDS/HIDS not enough to ensure security monitoring?

According to me in most cases SIEM is a political decision (budget) over a real need.

Improve this question

1 Answer 1

Reset to default
1

SIEM is nothing more than a central repo for all your monitoring systems (NIDS/HIDS) to report to. Grant it provides certain benefits but as you stated cost and deployment is rather large.

You don't buy a SIEM because your boss heard SIEM from a vendor, and thought hey we should have that. You buy them when the system grows to a size where it becomes more cost effective to add a system rather people. This varies based on how active your company is at actually looking into issues.

Remember SIEM doesn't just apply IDS system. It's quite broad and with systems like Splunk are quite versatile. Logs, SMS, email, etc which can come from all systems.

Improve this answer
2
  • Thanks for your answer Shane, you're right about the central repo. But in a concrete case of attack, which one is responsible for alerting, IDS or SIEM? Finally SIEM is a central repo for next forensic and legal purpose, but we can benefit from correlation rules, isn't it redundant? On another hand SIEM correlates events which mean nothing taken separately, but meaningful, once correlated. Thanks,
    – phackt
    Aug 10, 2016 at 13:59
  • Altering is all based on your company. Where I work both out systems and our SIEM alerts. Little redundant but just part of the deal. Forensics are usually more complicated since you typically need to have a COC with it so you typically uses SIEM to assist but maintain forensics.
    – Shane Andrie
    Aug 10, 2016 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .