SIEM Products
As far as i'm working in security field, i have been playing and saw quite a few SIEM products that available in the market right now and i'm glad to have such experiences. I will list the products here which is:
1. OSSIM - an open source SIEM but not much product supported, for the new beta, the interface is quite cool.
2. Tanable Security SC3 - it more for batch analysis and maybe forensics and i think it's not suitable for 24X7 monitoring since it don't have any alerting system and just eye balling.
3. CA eTrust Audit - the concept is quite good but the implementation and architecture is quite complicated. Got a lot problem that i need to face and too much layer to operate and seriously, i don't like it.
4. TriGeo - quite cool product but still got some limitation and not meet my criteria as an analyst to analyze.
5. ArcSight - The most coolest SIEM product in this world right now, but the price is totally high, but still i will vote for arc sight to be the number one. So much function and features can fulfill analyst task everyday 24X7.
6. Splunk - this is not SIEM actually but it was a log collector kind of, but it can perform as IT search engine and relate to security log analysis. I'm quite impress how splunk can perform the search. It's like a google installed in your own pc.
7. RSA envision - The number one ranking in the gartner report. Not yet play with it but i hope soon.
8. Symantec SIM - Not yet have experience on it but also soon, hopefully.
That's all and i'm glad that i have the chance to experience the top number of SIEM product in this world for today market.
That's all.
:)














