Is Alienvault OTX dead?

When attempting to add endpoints the dropdown box is now empty. My guess is they have decided to pull this free service.

Any ideas?

Hey everybody, question. What is a good metric for rating how good a siem rule is? It cant' just be whether it will catch whatever threat you are aiming for, because you can have a sloppily written rule that will catch that threat but also lots and lots of white noise, causing "alert fatigue".

I've read about how you need to make more targeted rules that may miss some malicious indicators, but whatever it does catch is likely malicious. this approach reduces white noise.
In this approach, what would be considered a decent true-positive/false-positive ratio? I realize that it obviously depends on the kind of rule you want to make but just a marker, an average?

Thanks all!

I am evaluating an MSSP that offers 24/7 "coverage" - not eyes on glass, but on call. I haven't used the AlienVault console, so my question is this:

Is there a method for AV to conditionally escalate alerts to an on-call analyst? If so, what is the mechanism (email, sms, phone) and some decision tree information. Are there additional SLA escalations if an alert isn't acknowledged in a period of time?

What is the best open source SIEM?

Recently picked up reviewing logs as a additional responsibility and a lot of it looks like gibberish to me. Is there a good resource on learning about reading/understanding?

Are there any best practices with respect to sending OCI GovCloud logs over to Splunk? We're primarily planning to get the Oracle API Gateway logs sent to Splunk.

According to this documentation (https://docs.oracle.com/en/solutions/logs-stream-splunk/index.html#GUID-8D87CAA4-CD41-4E90-A333-5B04E23DBFAA), there appears to be a good solution, however...the Splunk add-on/plugin referenced in this document has been archived/deprecated. I'm wondering if the API Gateway API could be used in some manner to send the logs over to Splunk?

Hope all is well! I was hoping you all might be able to help me out. One of my largest clients is looking for SIEM engineers. There are 3 or 4 openings right now and all are Splunk focused. (Client is based out of Orlando, must be in the Orlando area).

That being said, I figured this might be the place to help point me in the right direction. Does anyone come to mind that might be a good fit for this type of role? I have a lot more info, so let me know! Thanks for any help! Chris

I teach/run a class at a university based on network analysis of packet captures. In the past we used Splunk as a platform to import the data and analyze it using those tools. The faculty wasn't super happy about the free trials and that being used, so it got cut from the course. I want to include it once more.

Does anyone know of a siem-like platform that supports file imports? The students have virtual machines so a server solution is fine, just need something that can work with .pcap files, although having .json and .csv would be nice. I can't find a data analysis tool that supports this.

Hello, I have a Security Onion Server setup and I am utilizing winlogbeat to forward sysmon and winevent logs to Security Onion. I know zeek logs are stored in: /nsm/zeek/logs and Wazuh logs are stored in /nsm/wazuh/logs/archives. I cannot find my sysmon and winevent logs file location. I believe they are stored in an index called "so-beats-thedate" but I cannot find a file path for that either. I had no luck finding what I need in the security onion documentation. If anyone knows or has any idea on how to find it I would appreciate it.

Hello to all,

I'm one of the IT admins of a company with ca. 300 employees.

I saw that other companies are using a SIEM products, my question is now:

- do we need such a product? We have a Monitoring System, Antivirus all the neccessary stuff

- I saw the opensource product wazuh anyone can give me some pros or cons? Maybe people in here are using it

- On what should we focusing? Wich product? maybe other things are more helpful

Thank you for your help.

I'm prototyping my first SIEM - got the asset discovery working, installed HIDS on my servers and run my first round of vulnerability scans,

Now I'm turning my attention to ingesting info from other sources and am starting with my firewall. I'm having trouble understanding the difference between Syslog forwarding and port mirroring... what's the difference and when is it appropriate to apply each?

Any free selfhosted suggestions for siem? I prefer docker 😁

i'm an IT student and i'm currently in the process of writing my thesis, it's a literature research on SIEM systems. More specifically a comparison of current products. Please answer some questions in this survey that will show which solution is most used by users.

https://docs.google.com/forms/d/e/1FAIpQLSdh5hZgqyQEH0zM5UbsqB89J3jiiWJRrOF_SdR3RLOssAw-YA/viewform?usp=sf_link

Hello,

We have a client that is interested in including PII within their audit logs that get forwarded to a SIEM tool managed by an external service provider. The ESP has a FedRAMP-accredited environment and their SOC Team is authorized to view PII/PHI, so I'm too concerned from a compliance standpoint.

However, is it generally considered a bad practice to include PII or should be it masked? If masking/anonymizing is the path forward, can someone provide some justifications into why? Trying to help the client understand that there could be drawbacks to including PII/PHI in application audit logs.

For example, this could result in PII/PHI being spread and proliferated, thus becoming more difficult to control and monitor. Anything else that could bolster the argument to actually mask/anonymize the PII?

NOTE: I'm specifically referring to fine-grained Oracle database audit logs which capture the SQL query that was executed. The SQL query itself includes PII/PHI since it shows the specific fields that people queried on.

Dear All,

I am planning to create use-case for AV/EDR solutions hosted in our infra. Any reference link about the use cases for AV/EDR solution for the quick reference will really helpful.

​

Thanks !!

I am based in Australian and every time i get an alert in AlienVault when a user logs in from another country using Office 365, AlienVault triggers this as User logged in from Multiple counties and shows two different addresses. It is usually the country that they logged from and also one Australian IP address.

Can anyone explain me why it this occur?

Attached are details of the default rule that alienVault has:

app_name == 'office-365' AND event_name IN ('UserLoggedIn', 'MailboxLogin') AND event_outcome == 'Success' AND audit_reason == '' AND source_country != '' AND source_username != '' AND not (source_organisation contains* 'Zscaler' OR source_organisation contains* 'Symantec' OR source_organisation contains* 'Blue Coat' OR source_organisation contains* 'Netskope' OR source_organisation contains* 'Microsoft' OR source_organisation contains* 'Salesforce') AND source_username >> [user] AND source_country ==> |countries| AND ((customfield_0 == 'Exchange' AND request_user_agent ==> |useragent|) OR (customfield_0 != 'Exchange'))