Open Source centralized log management/SIEM solutions
"Youngquist, Jason R." <[email protected]> Mon, 26 Apr 2010 10:03:45 -0500
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
--===============0428556767== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_011BF7E1C7245B4FAE07A48CFD7CB58C018BEF4712CCEXCHMAILcci_" --_000_011BF7E1C7245B4FAE07A48CFD7CB58C018BEF4712CCEXCHMAILcci_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Is anyone using any Open Source or low cost centralized log management/SIEM= solution in a production environment which you would recommend? Specifically, I'm looking for: --scalability - must be able to handle hundreds of log sources - majority b= eing servers and network devices --good searching capability --ability to generate alerts --good reporting capability - pre-built reports would be nice --a solution auditors would approve --able to meet regulatory requirements such as PCI --fast implementation time - how long would it take to get the solution up = and running? There are more things I'd like, but these are the big requirements. If an Open Source solution, are there any companies that offer professional= services (ie. consulting/configuration assistance) so we could hit the gro= und running and not have to spend weeks/months configuring/creating rules/r= eports, etc. Ideally, the solution should have some commercial support beh= ind it so if we run into any issues we can speak to a knowledgeable person. For those QSAs out there, are there any Open Source solutions/low-cost solu= tions that you have seen implemented well and meet the PCI regulatory guide= lines? If so, what were they? If not, what were they lacking that commerc= ial products provide? For those of you with a home-grown/Open Source log management solution, do = you agree with the Gartner quote below? Why/why not? According to Gartner researchers, "Although [home-grown log management] may= prove effective for a limited set of data sources with clearly defined "st= rings" that the organization is searching for, most organizations quickly r= un into scalability issues, as well as issues using the data for situationa= l awareness in support of incident response. In most cases, internally deve= loped centralized application log solutions will fall short of meeting orga= nizational requirements." If you had to do it again would you "roll your own solution" or purchase a = commercial log management product? Appreciate any information you can provide. Thanks. Jason Youngquist Information Technology Security Engineer, Security+ Technology Services Columbia College 1001 Rogers Street, Columbia, MO 65216 (573) 875-7334 [email protected] http://www.ccis.edu --_000_011BF7E1C7245B4FAE07A48CFD7CB58C018BEF4712CCEXCHMAILcci_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:p=3D"urn:schemas-m= icrosoft-com:office:powerpoint" xmlns:a=3D"urn:schemas-microsoft-com:office= :access" xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s=3D"= uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs=3D"urn:schemas-microsof= t-com:rowset" xmlns:z=3D"#RowsetSchema" xmlns:b=3D"urn:schemas-microsoft-co= m:office:publisher" xmlns:ss=3D"urn:schemas-microsoft-com:office:spreadshee= t" xmlns:c=3D"urn:schemas-microsoft-com:office:component:spreadsheet" xmlns= :odc=3D"urn:schemas-microsoft-com:office:odc" xmlns:oa=3D"urn:schemas-micro= soft-com:office:activation" xmlns:html=3D"http://www.w3.org/TR/REC-html40" = xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc=3D"http://m= icrosoft.com/officenet/conferencing" xmlns:D=3D"DAV:" xmlns:Repl=3D"http://= schemas.microsoft.com/repl/" xmlns:mt=3D"http://schemas.microsoft.com/share= point/soap/meetings/" xmlns:x2=3D"http://schemas.microsoft.com/office/excel= /2003/xml" xmlns:ppda=3D"http://www.passport.com/NameSpace.xsd" xmlns:ois= =3D"http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir=3D"http://= schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds=3D"http://www.w3= .org/2000/09/xmldsig#" xmlns:dsp=3D"http://schemas.microsoft.com/sharepoint= /dsp" xmlns:udc=3D"http://schemas.microsoft.com/data/udc" xmlns:xsd=3D"http= ://www.w3.org/2001/XMLSchema" xmlns:sub=3D"http://schemas.microsoft.com/sha= repoint/soap/2002/1/alerts/" xmlns:ec=3D"http://www.w3.org/2001/04/xmlenc#"= xmlns:sp=3D"http://schemas.microsoft.com/sharepoint/" xmlns:sps=3D"http://= schemas.microsoft.com/sharepoint/soap/" xmlns:xsi=3D"http://www.w3.org/2001= /XMLSchema-instance" xmlns:udcs=3D"http://schemas.microsoft.com/data/udc/so= ap" xmlns:udcxf=3D"http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udc= p2p=3D"http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf=3D"http:/= /schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss=3D"http://sche= mas.microsoft.com/office/2006/digsig-setup" xmlns:dssi=3D"http://schemas.mi= crosoft.com/office/2006/digsig" xmlns:mdssi=3D"http://schemas.openxmlformat= s.org/package/2006/digital-signature" xmlns:mver=3D"http://schemas.openxmlf= ormats.org/markup-compatibility/2006" xmlns:m=3D"http://schemas.microsoft.c= om/office/2004/12/omml" xmlns:mrels=3D"http://schemas.openxmlformats.org/pa= ckage/2006/relationships" xmlns:spwp=3D"http://microsoft.com/sharepoint/web= partpages" xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/services/20= 06/types" xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/services/200= 6/messages" xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/Sli= deLibrary/" xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPortal= Server/PublishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" xmlns:= st=3D"" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Dus-ascii"= > <meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:Consolas; panose-1:2 11 6 9 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.MsoPlainText, li.MsoPlainText, div.MsoPlainText {mso-style-priority:99; mso-style-link:"Plain Text Char"; margin:0in; margin-bottom:.0001pt; font-size:10.5pt; font-family:Consolas;} p.MsoAcetate, li.MsoAcetate, div.MsoAcetate {mso-style-priority:99; mso-style-link:"Balloon Text Char"; margin:0in; margin-bottom:.0001pt; font-size:8.0pt; font-family:"Tahoma","sans-serif";} span.PlainTextChar {mso-style-name:"Plain Text Char"; mso-style-priority:99; mso-style-link:"Plain Text"; font-family:Consolas;} span.BalloonTextChar {mso-style-name:"Balloon Text Char"; mso-style-priority:99; mso-style-link:"Balloon Text"; font-family:"Tahoma","sans-serif";} span.EmailStyle21 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoPlainText>Is anyone using any Open Source or low cost central= ized log management/SIEM solution in a production environment which you would recommend?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Specifically, I'm looking for:<o:p></o:p></p> <p class=3DMsoPlainText>--scalability - must be able to handle hundreds of = log sources - majority being servers and network devices<o:p></o:p></p> <p class=3DMsoPlainText>--good searching capability<o:p></o:p></p> <p class=3DMsoPlainText>--ability to generate alerts<o:p></o:p></p> <p class=3DMsoPlainText>--good reporting capability – pre-built repor= ts would be nice<o:p></o:p></p> <p class=3DMsoPlainText>--a solution auditors would approve<o:p></o:p></p> <p class=3DMsoPlainText>--able to meet regulatory requirements such as PCI<= o:p></o:p></p> <p class=3DMsoPlainText>--fast implementation time – how long would i= t take to get the solution up and running?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>There are more things I’d like, but these are= the big requirements.<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>If an Open Source solution, are there any companies= that offer professional services (ie. consulting/configuration assistance) so we could hit the ground running and not have to spend weeks/months configuring/creating rules/reports, etc. Ideally, the solution should have some commercial support behind it so if we run into any issues we can speak to a knowledgeable person.<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>For those QSAs out there, are there any Open Source solutions/low-cost solutions that you have seen implemented well and meet t= he PCI regulatory guidelines? If so, what were they? If not, what = were they lacking that commercial products provide?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>For those of you with a home-grown/Open Source log management solution, do you agree with the Gartner quote below? Why/w= hy not? <o:p></o:p></p> <p class=3DMsoPlainText style=3D'margin-left:.5in'>According to Gartner researchers, "Although [home-grown log management] may prove effective= for a limited set of data sources with clearly defined "strings" that= the organization is searching for, most organizations quickly run into scalabil= ity issues, as well as issues using the data for situational awareness in suppo= rt of incident response. In most cases, internally developed centralized application log solutions will fall short of meeting organizational requirements."<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>If you had to do it again would you “roll you= r own solution” or purchase a commercial log management product? <o:p></o:p= ></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Appreciate any information you can provide.<o:p></o= :p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Thanks.<o:p></o:p></p> <p class=3DMsoPlainText>Jason Youngquist<o:p></o:p></p> <p class=3DMsoPlainText>Information Technology Security Engineer, Security+= <o:p></o:p></p> <p class=3DMsoPlainText>Technology Services<o:p></o:p></p> <p class=3DMsoPlainText>Columbia College<o:p></o:p></p> <p class=3DMsoPlainText>1001 Rogers Street, Columbia, MO 65216<o:p></= o:p></p> <p class=3DMsoPlainText>(573) 875-7334<o:p></o:p></p> <p class=3DMsoPlainText>[email protected]<o:p></o:p></p> <p class=3DMsoPlainText>http://www.ccis.edu<o:p></o:p></p> <p class=3DMsoPlainText> <o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> </div> </body> </html> --_000_011BF7E1C7245B4FAE07A48CFD7CB58C018BEF4712CCEXCHMAILcci_-- --===============0428556767== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ LogAnalysis mailing list [email protected] http://www.loganalysis.org/mailman/listinfo/loganalysis --===============0428556767==--