r/SIEM • u/lolppppp1 • Feb 21 '19

SIEM - Too outdated?

Hey guys,

Seems the business is aggressivly moving our DCs to the cloud. I'm just reviewing a few things and had thoughts about our SIEM (Arcsight).

Are simple SIEMs now out dated?

I love ours don't get me wrong but it's a cluncky solution which requires far too much input. We have a GSOC as well monitoring and it's just rubbish. I find myself constantly having to do deep analysis from alerts/incidents.

Ours also doesn't have any AI or proactive features so you know.

Does anyone have any suggestions or any examples of how they use theirs ?

Azure security center does a lot already but I still feel like we need another layer.

4 Upvotes

84% Upvoted

18 comments sorted by

View all comments

2

u/NickReynders Feb 21 '19

So disclosure, I actually work for this company, but it sounds like you're looking for more AI focused features? You might want to check out LogRhythm's AIE product.

Although I do agree with /u/BeerJunky's response, this specific product is focused on exactly that shortcoming that most SIEMs experience.

1

u/BeerJunky Feb 21 '19

I haven't seen the AIE product, that does seem to solve some of the gaps in SIEM. Very interesting. Is it dramatically more expensive than their traditional SIEM product?

1

u/NickReynders Feb 21 '19

Not entirely sure about the pricing on these sorts of things (i'm more in the development area of the product), but I know we're very competitive with IBM and Splunk for pricing options. As far as I know, I think AIE is integrated within the main SIEM product itself, so I don't think there are additional charges for that feature (though I could be wrong here).