RE: Open Source centralized log management/SIEM solutions
"Sandy Bird" <[email protected]> Mon, 26 Apr 2010 14:38:33 -0300
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============1601519026== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CAE567.4B8058FB" This is a multi-part message in MIME format. ------_=_NextPart_001_01CAE567.4B8058FB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Wow, people still use this list? I think the last post was from Anton back at the first of the year. =20 Honestly, assuming you want true open source, it will be a struggle. OSSIM (now AlienVault) is as close as you can probably get. I would guess it is becoming more "free" and less opensource by the day. If you are looking for "free" and not open source you have a few additional options. We have QRadar Slim Free Edition, but the free version is only good to 50 EPS... After 50 EPS you have to purchase appliances and licenses. The alerting and most of the correlation still works in the free version, but you lose the offense manager as well as asset and identity tracking. Splunk is another option (although might be a struggle for some of your alerting), and again the free version limits the amount of data you can deal with, or you have to purchase licenses. =20 Syslog-ng, grep and perl are always an option J... only half joking here... =20 Sandy =20 From: [email protected] [mailto:[email protected]] On Behalf Of Youngquist, Jason R. Sent: Monday, April 26, 2010 12:04 PM To: '[email protected]' Subject: [logs] Open Source centralized log management/SIEM solutions =20 Is anyone using any Open Source or low cost centralized log management/SIEM solution in a production environment which you would recommend? =20 Specifically, I'm looking for: --scalability - must be able to handle hundreds of log sources - majority being servers and network devices --good searching capability --ability to generate alerts --good reporting capability - pre-built reports would be nice --a solution auditors would approve --able to meet regulatory requirements such as PCI --fast implementation time - how long would it take to get the solution up and running? =20 =20 There are more things I'd like, but these are the big requirements. =20 =20 If an Open Source solution, are there any companies that offer professional services (ie. consulting/configuration assistance) so we could hit the ground running and not have to spend weeks/months configuring/creating rules/reports, etc. Ideally, the solution should have some commercial support behind it so if we run into any issues we can speak to a knowledgeable person. =20 =20 For those QSAs out there, are there any Open Source solutions/low-cost solutions that you have seen implemented well and meet the PCI regulatory guidelines? If so, what were they? If not, what were they lacking that commercial products provide? =20 =20 For those of you with a home-grown/Open Source log management solution, do you agree with the Gartner quote below? Why/why not? =20 According to Gartner researchers, "Although [home-grown log management] may prove effective for a limited set of data sources with clearly defined "strings" that the organization is searching for, most organizations quickly run into scalability issues, as well as issues using the data for situational awareness in support of incident response. In most cases, internally developed centralized application log solutions will fall short of meeting organizational requirements." =20 If you had to do it again would you "roll your own solution" or purchase a commercial log management product?=20 =20 =20 Appreciate any information you can provide. =20 =20 Thanks. Jason Youngquist Information Technology Security Engineer, Security+ Technology Services Columbia College 1001 Rogers Street, Columbia, MO 65216 (573) 875-7334 [email protected] http://www.ccis.edu =20 =20 ------_=_NextPart_001_01CAE567.4B8058FB Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" = xmlns:p=3D"urn:schemas-microsoft-com:office:powerpoint" = xmlns:a=3D"urn:schemas-microsoft-com:office:access" = xmlns:dt=3D"uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" = xmlns:s=3D"uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" = xmlns:rs=3D"urn:schemas-microsoft-com:rowset" xmlns:z=3D"#RowsetSchema" = xmlns:b=3D"urn:schemas-microsoft-com:office:publisher" = xmlns:ss=3D"urn:schemas-microsoft-com:office:spreadsheet" = xmlns:c=3D"urn:schemas-microsoft-com:office:component:spreadsheet" = xmlns:odc=3D"urn:schemas-microsoft-com:office:odc" = xmlns:oa=3D"urn:schemas-microsoft-com:office:activation" = xmlns:html=3D"http://www.w3.org/TR/REC-html40" = xmlns:q=3D"http://schemas.xmlsoap.org/soap/envelope/" = xmlns:rtc=3D"http://microsoft.com/officenet/conferencing" = xmlns:D=3D"DAV:" xmlns:Repl=3D"http://schemas.microsoft.com/repl/" = xmlns:mt=3D"http://schemas.microsoft.com/sharepoint/soap/meetings/" = xmlns:x2=3D"http://schemas.microsoft.com/office/excel/2003/xml" = xmlns:ppda=3D"http://www.passport.com/NameSpace.xsd" = xmlns:ois=3D"http://schemas.microsoft.com/sharepoint/soap/ois/" = xmlns:dir=3D"http://schemas.microsoft.com/sharepoint/soap/directory/" = xmlns:ds=3D"http://www.w3.org/2000/09/xmldsig#" = xmlns:dsp=3D"http://schemas.microsoft.com/sharepoint/dsp" = xmlns:udc=3D"http://schemas.microsoft.com/data/udc" = xmlns:xsd=3D"http://www.w3.org/2001/XMLSchema" = xmlns:sub=3D"http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/"= xmlns:ec=3D"http://www.w3.org/2001/04/xmlenc#" = xmlns:sp=3D"http://schemas.microsoft.com/sharepoint/" = xmlns:sps=3D"http://schemas.microsoft.com/sharepoint/soap/" = xmlns:xsi=3D"http://www.w3.org/2001/XMLSchema-instance" = xmlns:udcs=3D"http://schemas.microsoft.com/data/udc/soap" = xmlns:udcxf=3D"http://schemas.microsoft.com/data/udc/xmlfile" = xmlns:udcp2p=3D"http://schemas.microsoft.com/data/udc/parttopart" = xmlns:wf=3D"http://schemas.microsoft.com/sharepoint/soap/workflow/" = xmlns:dsss=3D"http://schemas.microsoft.com/office/2006/digsig-setup" = xmlns:dssi=3D"http://schemas.microsoft.com/office/2006/digsig" = xmlns:mdssi=3D"http://schemas.openxmlformats.org/package/2006/digital-sig= nature" = xmlns:mver=3D"http://schemas.openxmlformats.org/markup-compatibility/2006= " xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns:mrels=3D"http://schemas.openxmlformats.org/package/2006/relationshi= ps" xmlns:spwp=3D"http://microsoft.com/sharepoint/webpartpages" = xmlns:ex12t=3D"http://schemas.microsoft.com/exchange/services/2006/types"= = xmlns:ex12m=3D"http://schemas.microsoft.com/exchange/services/2006/messag= es" = xmlns:pptsl=3D"http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/= " = xmlns:spsl=3D"http://microsoft.com/webservices/SharePointPortalServer/Pub= lishedLinksService" xmlns:Z=3D"urn:schemas-microsoft-com:" = xmlns:st=3D"" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Wingdings; panose-1:5 0 0 0 0 0 0 0 0 0;} @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} @font-face {font-family:Consolas; panose-1:2 11 6 9 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.MsoPlainText, li.MsoPlainText, div.MsoPlainText {mso-style-priority:99; mso-style-link:"Plain Text Char"; margin:0in; margin-bottom:.0001pt; font-size:10.5pt; font-family:Consolas;} p.MsoAcetate, li.MsoAcetate, div.MsoAcetate {mso-style-priority:99; mso-style-link:"Balloon Text Char"; margin:0in; margin-bottom:.0001pt; font-size:8.0pt; font-family:"Tahoma","sans-serif";} span.PlainTextChar {mso-style-name:"Plain Text Char"; mso-style-priority:99; mso-style-link:"Plain Text"; font-family:Consolas;} span.BalloonTextChar {mso-style-name:"Balloon Text Char"; mso-style-priority:99; mso-style-link:"Balloon Text"; font-family:"Tahoma","sans-serif";} span.EmailStyle21 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;} span.EmailStyle22 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><span style=3D'color:#1F497D'>Wow, people still use = this list? I think the last post was from Anton back at the first of the = year.<o:p></o:p></span></p> <p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p> <p class=3DMsoNormal><span style=3D'color:#1F497D'>Honestly, assuming = you want true open source, it will be a struggle. OSSIM (now AlienVault) is as = close as you can probably get. I would guess it is becoming more = “free” and less opensource by the day. If you are looking for = “free” and not open source you have a few additional options. We have = QRadar Slim Free Edition, but the free version is only good to 50 EPS… = After 50 EPS you have to purchase appliances and licenses. The alerting and most = of the correlation still works in the free version, but you lose the offense = manager as well as asset and identity tracking. Splunk is another option (although might be a struggle for some of your alerting), and again the = free version limits the amount of data you can deal with, or you have to = purchase licenses. <o:p></o:p></span></p> <p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p> <p class=3DMsoNormal><span style=3D'color:#1F497D'>Syslog-ng, grep and = perl are always an option </span><span = style=3D'font-family:Wingdings;color:#1F497D'>J</span><span style=3D'color:#1F497D'>… only half joking = here…<o:p></o:p></span></p> <p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p> <p class=3DMsoNormal><span = style=3D'color:#1F497D'>Sandy<o:p></o:p></span></p> <p class=3DMsoNormal><span = style=3D'color:#1F497D'><o:p> </o:p></span></p> <div> <div style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt = 0in 0in 0in'> <p class=3DMsoNormal><b><span = style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>= </b><span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> = [email protected] [mailto:[email protected]] <b>On Behalf Of = </b>Youngquist, Jason R.<br> <b>Sent:</b> Monday, April 26, 2010 12:04 PM<br> <b>To:</b> '[email protected]'<br> <b>Subject:</b> [logs] Open Source centralized log management/SIEM = solutions<o:p></o:p></span></p> </div> </div> <p class=3DMsoNormal><o:p> </o:p></p> <p class=3DMsoPlainText>Is anyone using any Open Source or low cost = centralized log management/SIEM solution in a production environment which you would recommend?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Specifically, I'm looking for:<o:p></o:p></p> <p class=3DMsoPlainText>--scalability - must be able to handle hundreds = of log sources - majority being servers and network devices<o:p></o:p></p> <p class=3DMsoPlainText>--good searching capability<o:p></o:p></p> <p class=3DMsoPlainText>--ability to generate alerts<o:p></o:p></p> <p class=3DMsoPlainText>--good reporting capability – pre-built = reports would be nice<o:p></o:p></p> <p class=3DMsoPlainText>--a solution auditors would = approve<o:p></o:p></p> <p class=3DMsoPlainText>--able to meet regulatory requirements such as = PCI<o:p></o:p></p> <p class=3DMsoPlainText>--fast implementation time – how long = would it take to get the solution up and running?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>There are more things I’d like, but these = are the big requirements.<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>If an Open Source solution, are there any = companies that offer professional services (ie. consulting/configuration assistance) so = we could hit the ground running and not have to spend weeks/months configuring/creating rules/reports, etc. Ideally, the solution = should have some commercial support behind it so if we run into any issues we = can speak to a knowledgeable person.<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>For those QSAs out there, are there any Open = Source solutions/low-cost solutions that you have seen implemented well and = meet the PCI regulatory guidelines? If so, what were they? If not, = what were they lacking that commercial products provide?<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>For those of you with a home-grown/Open Source = log management solution, do you agree with the Gartner quote below? = Why/why not? <o:p></o:p></p> <p class=3DMsoPlainText style=3D'margin-left:.5in'>According to Gartner researchers, "Although [home-grown log management] may prove = effective for a limited set of data sources with clearly defined "strings" = that the organization is searching for, most organizations quickly run into = scalability issues, as well as issues using the data for situational awareness in = support of incident response. In most cases, internally developed centralized application log solutions will fall short of meeting organizational requirements."<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>If you had to do it again would you “roll = your own solution” or purchase a commercial log management product? = <o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Appreciate any information you can = provide.<o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> <p class=3DMsoPlainText>Thanks.<o:p></o:p></p> <p class=3DMsoPlainText>Jason Youngquist<o:p></o:p></p> <p class=3DMsoPlainText>Information Technology Security Engineer, = Security+<o:p></o:p></p> <p class=3DMsoPlainText>Technology Services<o:p></o:p></p> <p class=3DMsoPlainText>Columbia College<o:p></o:p></p> <p class=3DMsoPlainText>1001 Rogers Street, Columbia, MO = 65216<o:p></o:p></p> <p class=3DMsoPlainText>(573) 875-7334<o:p></o:p></p> <p class=3DMsoPlainText>[email protected]<o:p></o:p></p> <p class=3DMsoPlainText>http://www.ccis.edu<o:p></o:p></p> <p class=3DMsoPlainText> <o:p></o:p></p> <p class=3DMsoPlainText><o:p> </o:p></p> </div> </body> </html> ------_=_NextPart_001_01CAE567.4B8058FB-- --===============1601519026== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ LogAnalysis mailing list [email protected] http://www.loganalysis.org/mailman/listinfo/loganalysis --===============1601519026==--