0

Instead of collecting various logs into the SIEM, can a full packet capture solution be better in terms of having to manage so many log sources?

1
  • You still have as many or more sources of logs: every node communicating on the network. And then you still have a need to store all those packets in one place, which means that you end up with a SIEM-like structure anyway. And then packets only reveal network-level events, not application-level events. You might need to expand and explain your question.
    – schroeder
    Nov 11 '20 at 9:30
4

Just by capturing the full traffic the task does not magically gets less complex. The traffic still needs to be processed and the information extracted. In contrary, capturing all traffic inside a huge network and processing it in real-time is a huge task: there is lots of bandwidth needed to collect all traffic in the first place and huge processing power needed to process it.

It scales much better to extract the relevant information as soon as possible from the network and only feed the pre-processed information into the SIEM. Apart from that SIEM usually not only get information from the network traffic, but also include information from the endpoints, like which applications are running and what they are doing, authentication errors etc. This is the kind of information which cannot be directly derived from the network traffic.

1

There is solutions such as moloch, or commercial ones that can store pcaps at big scale, however as Steffen mention the system will need a lot of resources, what the majority of the systems do is use netflow data is you can summarize as an abstraction of the flow and send this data to the SIEM system. Of course if you want to be granular you will need a solution that will take the pcap files but in the majority of the cases by feeding with netflow data the SIEM will be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.