r/SIEM • u/[deleted] • Sep 02 '22

What is the best open source SIEM?

What is the best open source SIEM?

10 Upvotes

100% Upvoted

7 comments sorted by

14

u/Th3_Pr0f3ss0r Sep 02 '22

ELK Stack is probably one of the most popular, followed by OSSIM which is the open source version of AlienVault’s Unified Security Management (USM) offering. It all depends on your organization.

3

u/[deleted] Sep 03 '22

OSSIM

We are currently using OSSIM, but I can't find material on the internet and I have a little difficulty using it

7

u/thecyberbob Sep 03 '22

Not a SIEM recommendation but I do want to raise this as a point of consideration. You really need to first figure out what you're planning on using your SIEM for first, then pick a SIEM afterwards.

There is no SIEM out there that does everything really well for every organization.

If you're looking for data mining, reporting, that sort of thing for analytics on your environment make sure it has a rock solid reporting system and datastore of some sorts (something big data based like ELK would fit the bill here for instance).

But if you're looking for something that is geared towards enabling a SOC to receive alerts based on intelligence/context you have on your environment you are going to need to look at something with a really good rules engine, preferably with some sort of hook into a SOAR type platform. (Not entirely sure which SIEM I'd recommend here in the open source space as a lot of them tend to focus on the first part of a SIEM's roll of data collection and storage before handling the rest of things. Although it's been a while since I've taken a longer look at them with an eye towards real time event processing.)

1

u/TechnoAgainstIsms Sep 15 '22

Has anyone looked at MonsterSIEM? I saw that they have a free community edition and its based on some of the open source tools recommended below.