when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network
Or can we do away with SIEM and have only Network Forensic tools installed in a enterprise network.
Sure, you can probably get away with forensic tools installed in an enterprise network. However, said tools are probably scattered all over the network.
For convenience sake, you will probably want to aggregate all the data and logs generated by the tools in one location. You will probably want to create a nice dashboard for glance-able information because who likes looking at logs?
You probably also don't want to hire a guy to stare at the logs all day in case something goes wrong. You probably want a way to alert your administrators in case something goes wrong....
At this point, you are basically rolling your own SIEM anyway so you might as well use one that has already been written and battle-tested.