Re: SIM solution - Objectives ?
"Tom Le" <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
> Does it make sense to receive High alerts and take a 15 minute > response when a login failure happens on a few servers.? The big challenge here isn't an SLA, which most MSSP's will provide. The big question is what is a high severity alert? If you rely on IDS/IPS securities of "high" or "critical" you will generate a ton of false positives. Does the MSSP have their own severity ranking mechanism? What factors do they consider... such as correlation analysis, anomaly detection, vulnerability scan data, host & fw messages in addition to IDS/IPS, asset value, 0-day information, your corporate security policies and other customizations. Finally, is there a human security analyst that needs to review the above data as part of the SLA and do they have subjective ability to determine what event(s) comprise a high severity alert? You will have a harder time getting the MSSP to define what is "high severity" than agreeing to a 15-min SLA. Tom Le _______________________________________________ LogAnalysis mailing list [email protected] http://www.loganalysis.org/mailman/listinfo/loganalysis