Oh no, its me vs Raffy again :-)
I am curious to know what SIM product can handle un-tuned IDS alerts in
addition to firewall logs, server logs, and application logs. How accurate
I am not here to sell a particular SIM product (but do contact me if you
need more info on that). It will suffice to say that the best SIM products
can do the above, provided that the hardware was spec'ed correctly before
the implementation.
is the list of message ID's and the message parsing? I doubt that there is a
SIM vendor that has a correlation engine that can handle a fraction of the
traffic in an average data-center or enterprise network.
There certainly is...
Can they provide
packaged reporting and alert management?
Absolutely.
Flat-file or relational database?
I do know that some folks use custom-coded "flat-file-like" "databases",
but IMHO their advantages are not as significant as some think. At the
same time, their disadvantages are obvious :-)
Don't forget about your SOC operators who have to manage the message queue
and respond to all of the alerts.
Sure, a good SIM can handle the process side of the SOC operation.
You can not just push traffic to a SIM and
have it magically (and accurately) generate some golden nugget message.
That is actually a key point! That is what I would call a 'ultimate SIM
dream'. How close the real products are to that? It depends, but clearly
they are not there yet.
What
are you using to gather vulnerability assessment information and how is the
SIM correlating against that information? Valid alerts need to be measured
This actually presents the "secret sauce" of some SIM vendors and, in
general, goes too deep into product specifics. Do contact me if you want
more details on one possible way of doing it. In general, SIM will use
vuln data to automatically qualify IDS alerts as well compute various
risk metrics.
Best,
--
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
http://www.info-secure.org
http://www.securitywarrior.com
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
