PaulDotCom mailing list archives
SMB Security Event Management Tool
From: rgula at tenablesecurity.com (Ron Gula)
Date: Fri, 10 Apr 2009 10:32:40 -0400
When I initially wrote the Dragon IDS, I had a lot of customers tell me about how much they hated to have to fire up MS-SQL or some other database that was outside a product they were using, especially if it was a security product. For the Tenable Security Center and Log Correlation Engine, there are no traditional databases involved. Everything is written to the disk and indexed for performance. If you loose power, you have minimal corruption and it works real well in a VM type of environment. Ron Gula Tenable Network Security Neils Christoffersen wrote:
Q1 also uses ariel in its QRadar product (not sure about the free version). On 4/9/09, Dan McGinn-Combs <dgcombs at gmail.com> wrote:Has anyone tried Juniper's STRM set of products? I had a pitch by them the other day touting their use of a proprietary database called Ariel (yeah... under the sea. I know) which solves not only your alerting, reporting and forensics issues but also world hunger and peace in the Middle East. After having used MySQL back ends before, I'm a little less than thrilled by products that incorporate that as a repository for XXX log items per second. Dan On Wed, Apr 8, 2009 at 10:02 PM, airwolf airwolf <airwolf.security at gmail.comwrote: I would recommend at looking at: Splunk and Snare. Both tools combined give you great flexibility, not audit nirvana but close. On Tue, Apr 7, 2009 at 8:55 PM, Jim Manley <jmanley at aledobb.com> wrote:I'm looking for a security event management tool (log correlation, auditing, etc.) that would be suitable for small/medium size business environment. The environments in which it would be deployed into are primarily MS Windows with a smattering of Linux. It doesn't need a lot of bells and whistles and it needs to be fairly easy to set up and operate (the people doing the work are primarily physical security types with the average user's knowledge). Ideally it needs to trigger on Windows event manager and security manager codes for things like failed logins, etc.-- Dan McGinn-Combs, Security+, GSEC, CISSP, CISA dgcombs at gmail.com Grand Central: +1 404 492 7532 Peachtree City, Georgia USA
Current thread:
- SMB Security Event Management Tool, (continued)
- SMB Security Event Management Tool Will Metcalf (Apr 07)
- SMB Security Event Management Tool Chris Merkel (Apr 08)
- SMB Security Event Management Tool Jonathan Moore (Apr 08)
- SMB Security Event Management Tool Chris Merkel (Apr 08)
- SMB Security Event Management Tool Tim Krabec (Apr 08)
- SMB Security Event Management Tool Jason Wood (Apr 08)
- SMB Security Event Management Tool Tim Krabec (Apr 08)
- SMB Security Event Management Tool Jonathan Moore (Apr 08)
- SMB Security Event Management Tool Dan McGinn-Combs (Apr 09)
- SMB Security Event Management Tool Neils Christoffersen (Apr 09)
- SMB Security Event Management Tool Ron Gula (Apr 10)
- SMB Security Event Management Tool John Sawyer (Apr 08)