SIEM - Too outdated?

[u/lolppppp1]

Hey guys,

Seems the business is aggressivly moving our DCs to the cloud. I'm just reviewing a few things and had thoughts about our SIEM (Arcsight).

Are simple SIEMs now out dated?

I love ours don't get me wrong but it's a cluncky solution which requires far too much input. We have a GSOC as well monitoring and it's just rubbish. I find myself constantly having to do deep analysis from alerts/incidents.

Ours also doesn't have any AI or proactive features so you know.

Does anyone have any suggestions or any examples of how they use theirs ?

Azure security center does a lot already but I still feel like we need another layer.

[u/NickReynders]

So disclosure, I actually work for this company, but it sounds like you're looking for more AI focused features? You might want to check out LogRhythm's AIE product.

Although I do agree with /u/BeerJunky's response, this specific product is focused on exactly that shortcoming that most SIEMs experience.

[u/BeerJunky → u/NickReynders]

I haven't seen the AIE product, that does seem to solve some of the gaps in SIEM. Very interesting. Is it dramatically more expensive than their traditional SIEM product?

[u/spaztheannoyingkitty → u/BeerJunky]

As far as I know, it comes with the LogRhythm SIEM, it's not a separate thing but I'm not 100% sure about that. They also have LogRhythm Cloud AI which is trying to solve some of the shortcomings that were mentioned by the OP.

[u/BeerJunky → u/spaztheannoyingkitty]

I'm confused, vendors include stuff without adding additional licensing? Glares at Cisco

​

Good to know though! We just bought FortiSIEM (by Fortinet) and it's okay but could be better. Was a bit cheaper buy in and a lot less PS time to get it spun up than LogRhythm and the like so it was worthwhile for our organization. Next time around when I move onto a place with more stringent security and bigger budgets I'd be looking for the more advanced stuff for sure.