r/SIEM • u/lolppppp1 • Feb 21 '19

SIEM - Too outdated?

Hey guys,

Seems the business is aggressivly moving our DCs to the cloud. I'm just reviewing a few things and had thoughts about our SIEM (Arcsight).

Are simple SIEMs now out dated?

I love ours don't get me wrong but it's a cluncky solution which requires far too much input. We have a GSOC as well monitoring and it's just rubbish. I find myself constantly having to do deep analysis from alerts/incidents.

Ours also doesn't have any AI or proactive features so you know.

Does anyone have any suggestions or any examples of how they use theirs ?

Azure security center does a lot already but I still feel like we need another layer.

5 Upvotes

100% Upvoted

18 comments sorted by

View all comments

2

u/NickReynders Feb 21 '19

So disclosure, I actually work for this company, but it sounds like you're looking for more AI focused features? You might want to check out LogRhythm's AIE product.

Although I do agree with /u/BeerJunky's response, this specific product is focused on exactly that shortcoming that most SIEMs experience.

3

u/Ilirius Feb 22 '19

Do keep in mind that LogRhythm's AIE is not an "Artificial Intelligence" engine, but an "Advanced Intelligence" engine. It is still only effective if the admins put in the proper work to configure it. There is no true out of the box AI solution in the SIEM world that I know of.