On the 28th Chaos Communication Congress organized by Chaos Computer Club in Berlin, network security specialist Chris Kubecka talks about how correlation and visualization of network log data from different devices can support the process of finding potential threats and malware. Usually a network is comprised of a variety of different devices that each generates log files in its own format. Having a separate console for each of these devices
Tags: attack, conference, security, SIEM, talk, tool, visualization6 articles Tag SIEM
LogRhythm
LogRhythm is a SIEM that can be applied either in smaller organizations as a single software instance or in midsize to large organizations as a combination of different software applications. It offers log management, event management, reporting, user and file integrity monitoring. The product is easily and quickly deployed due to a helpful configuration wizard. Though LogRhythm is capable of event correlation, compared to its competitors it’s very basic and optimized for the most common use cases. Gartner has positioned the product in their Magic Quadrant for Security Information and Event Management as one of the leaders.
Tags: alerts, commercial, dashboard, desktop, Interactive, interface, network, security, SIEM, toolSentinel, Security Manager (NetIQ)
The company NetIQ offers two SIEM solutions: Sentinel and Security Manager. Sentinel is a product originally offered by Novell. With the recent acquisition of the company by NetIQ there are two products overlapping in their functionality. In the future all functionality will be merged into the Sentinel solution. Sentinel’s strength lies in event correlation and real-time event management. Security Manager lacks this functionality and focuses more on host- and agentbased monitoring capabilities for server platforms, something missing in most SIEMs. Sentinel is a leader in the Gartner Magic Quadrant 2012
Tags: alerts, commercial, dashboard, desktop, Interactive, interface, network, security, SIEM, toolEnterprise Security Manager (McAfee)
McAfee NitroSecurity is a software that offers SIEM functionality and log management in one single tool separating it from other SIEM systems. It is scalable and has a high performance, which makes it especially useful for organizations that need to analyse huge numbers of events. The company itself emphasizes the speed of the product as an outstanding feature. It is one of the five products positioned as leader in the Magic Quadrant for Security Information and Event Management.
Tags: alerts, attack, commercial, dashboard, network, security, SIEM, toolQ1 Labs (IBM)
IBM offers an extensive security system solution called Q1 Labs. This includes several products for different security aspects, like, for example, QRadar Log Manager for collecting, archiving and analyzing network and security event logs or QRadar SIEM for real-time analysis of security alerts and correlating data from different sources to detect any threats. The product distinguishes itself from other products by its ability to collect and process NetFlow data, by deep packet inspection (DPI) and behavior analysis for all supported event sources. According to Gartner it can be considered one of the leaders in the field (Gartner 2012).
HP Enterprise Security Products and ArcSight
In their business unit ESP (Enterprise Security Products) Hewlett Packard offers several security tools in three different areas: Application Security (Fortify), Information Security (ArcSight) and Network and Cloud Security (Tipping Point). While Fortify is targeted at software security, ArcSight can be considered a SIEM (Security Information and Event Management) system. TippingPoint is a defense system against cyber attacks and threats.
According to Gardner ArcSight can be considered as one of the leaders in the field of SIEMs. There are different ArcSight SIEM solutions available depending, if you are interested in recording and analyzing log information or if you are focussing on real-time security events. The choice for one of the solutions is also dependent on the size of your network.
Though ArcSight is one of the most popular products on the market on the market it has its shortcomings:
Tags: commercial, dashboard, graph, Interactive, network, security, SIEM, tool, visualization“ArcSight Enterprise Security Manager is complex in terms of deployment and performance management.”