Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation
Like Niksun or Solera solution do ?
I'm talking about a SIEM and record solution of a entire network with intelligence investigation features, this tool of course can also be used sometimes for lawful interception in an ISP for example.
I found on the web some network solution from niksun or websense or for example on Solera.
I'm searching a solution to: - record traffic from 1 day to 36 month and have it on a accessible storage for analysys - features to make post analysis of the content from layer 4 to layer 7 (ip view but also content view of common protocol, chat communication, mail communication and any related traffic ). - alerting features triggered on rule based about traffic. example i can made an alert on detecting of a common word in a communication on a subset of the traffic (example only mail or chat traffic from a specific ip address) - Must have high bandwidth support, protocol identification at every layer, statistic reports and a common way to navigate the data.
What i'm asking for is not for a list of tool when an incident become but about solution to record all the traffic and to analyze all the traffic to identify data leak, misconfiguration and no-policy related utilization of the network.
anyone have experience on its solution and can share information and talk about it ?