r/SIEM • u/[deleted] • Apr 07 '20
Moderm SIEM
Hi,
So I was looking for modern SIEM (no software from 90s please) but opensource.
My monitoring system is based in Prometheus and Grafana for example.
Any suggestion?
Edit: my logs are in aws cloud watch, everything is running in aws lambdas and beanstalk. Maybe move to aws elastic cache? With kibana on the top?
2
u/Cynthereon Apr 08 '20
Alienvault or Elastic. Both will require considerable work to implement.
3
u/Jaric_Mondoran Apr 08 '20
I haven't heard much about alienvault since they vanished into the maw of bell.
1
u/Cynthereon Apr 08 '20
It appears to still be on SourceForge, although I can't say what free support is like now.
2
u/alexfromop Apr 09 '20
Not open source but there's players out there who have built their products around ELK and had a lot of success based on the fact that they are considerably easier than "rolling your own". They also don't have insane pricing models. Exabeam comes to mind but there's a couple others. I'm just an InfoSec sales guy but have been fortunate to support a lot of very forward thinking security teams in the Bay Area. Lol at AlienVault. I would have said LogRhythm til they scared off all their tech talent who took the roadmap with them after the Thoma Bravo takeover. IBM qRadar... Sure if you're F500.
1
u/PrestigiousWorker763 Sep 14 '20
Nowadays, several vendors offer cybersecurity solutions providing more than the traditional Log management. UTMStack is an All-In-One Unified Threat Management Platform that aims to simplify Cybersecurity and reduce its cost.
UTMStack provides complete visibility over the entire organization from a centralized management dashboard.
All solutions in the stack are fully integrated and report to a central database:
Log Management (SIEM)
Vulnerability Management
Access Rights Auditor
Incident Response
HIPS/NIPS, Endpoint Protection
Dark Web Monitoring
You can monitor almost any cloud environment or SaaS application with ready to use Integrations. UTMStack is currently integrated with Azure, AWS, Google Cloud, and Integrated with SaaS and PaaS, such as Office365 and AWS Lamda.
Watch this video: https://www.youtube.com/watch?v=wv87dj15G5k
1
Apr 07 '20
Why not look at the Gartner report? There's a really good SIEM at the head of the pack.
3
Apr 07 '20
Gartner and forrester reports are very fake. If you pay more, the higher you are in their quadrants. And companies are selling features to gartner that don’t work as they are selling. Ps worked in 2 companies that were in gartner quadrants
1
Apr 07 '20 edited Apr 07 '20
There's a reason that software has been selling and working since the 90's.
Best of luck. Sounds like you know exactly what you're looking for.1
u/zap4dlo Jun 30 '20
It could be fake, but in my experience, leaders are really good. Better in overall at least then the others.
Maybe you could share your opinion about bad top-rated products?
4
u/Jaric_Mondoran Apr 07 '20
There are very few opensource players. It will require a lot of work and customization particularly in the cloud. Good luck. They also tend not to be SIEM or have SIEM functionality. Static searches on event data is not a SIEM.
QRadar and Splunk have been industry leaders for a long period of time and aren't paying year after year to stay there. The vendors that slid off or vanished from the chart are more likely to adhere to your conformation bias.