Our partners require such configuration as

1) vulnerability scanner A (well known in CIS area)

2) SIEM B (leaders of the market)

And they should perform a scan of the network, get a report then forward it to the SIEM supposedly to challenge the findings against IOC's.

They insist to get the report into the SIEM -- we don't want to argue with them.

Does challenging the report against IOC's via SIEM sound right to you?

  • It is unclear what information they already feed into their SIEM. But it might well be that they correlate the information collected by the SIEM with the scan reports to get a larger picture of what need to be fixed and what might be false alarms. Thus if they already have a tool to do the job, then why add another one? Maybe the new tool is a bit better but it is still an additional tool which need to be learned and maintained, thus maybe adding more work instead of reducing work. Impossible to tell what's best based on the (lack of) detail in your question. – Steffen Ullrich Dec 25 '19 at 18:13
  • Removed the question about Nessus as it is opinion-based. – schroeder Dec 25 '19 at 20:10
  • Where do you think the report should go? – schroeder Dec 25 '19 at 20:12

Feeding vulnerability reports into a SIEM is normal practice.

As for comparing data found by scans against IoCs, that too is normal practice. Where that is done (in a SIEM or not) really doesn't matter.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.