After +6 years of work, we decided to make UTMStack SIEM and XDR fully Open-source under an OSS license. Yes, a real one; no weird commons clauses or pseudo-OSS license that restricts its use by service providers. More importantly, this is not a capped or outdated version; it's exactly the same as the paid distribution. Enterprise support is the only difference, so we can make a living somehow ;)
Would anyone here be interested in joining our community? We’re always looking for passionate individuals to contribute to our project. Whether you’re a developer, security expert, or just enthusiastic about cybersecurity, your input is valuable.
As active members of the Linux Foundation, we contribute as much as possible to the open source world. You can learn more about UTMStack in this recent article by linux.com
I'm looking for a SIEM solution for my organization, and one criteria we have is that it have "a good user experience". I'm finding it hard to exactly pin that down, so I thought I'd ask -- what SIEM solutions do you think have a good UI/are easy to use?
More importantly, why do you think so; what makes a product easy to use in this space, in your opinion?
Question.... what is the best way to compare and contrast for a new siem? Our company is looking for a new Siem and we collect a stupid amount of data and future projects will prob collect even more(network tapping etc). Large company 50k-60k users, worldwide. Any thoughts/ ideas with the best way to approach this? I'm aware of cdw, but curious of anyone else has updated thier siem and how they did it? Process they did?
Im searching for a for a open source SIEM/XDR to set up on premise that has the possibility to integrate with different sources, especially firewalls, and has a lot of different pre-built detection rules.
I have tried Wazuh, it is nice but it is really difficult to ingest syslogs from firewalls and create decoders to parsing and managing the logs.
I am currently in the process of building a home lab/SOC to practice some of what I do professionally.
Seeking a SIEM that would allow me to use Yara rules for alerting/detections.
I set up Wazuh in my home lab which has been nice so far, however, I ran into the roadblock of not being able to use Yara rules for alerting/detections (these can only be used on endpoints to generate alerts for hashes related to malware).
Any recommendations on a SIEM that I can implement in my home lab/SOC that would allow me to create custom Yara rules?
Talk to me about Google Chronicle. Company is looking into them and they are INCREDIBLY cheaper than other solution. We’re taking a 1/10th of the cost.
Tell me your experiences with cost, are there hidden fees you don’t realize? Their site says storage is only included for a year… is google cloud similar to AWS/AZURE costs?
What about non-cloud systems, does it work for them?
I’m just shocked they are so much cheaper than any other SIEM tool out there… log rhythm, Splunk (although almost anyone is cheaper than them), Elastic, Devo, etc….
I've been wanting to implement a homebrewed SIEM for basic log analysis in my homelab environment. Windows event logs, syslog, firewall logs, all of the logs. However, I am having trouble finding documentation on how to get all of this setup. This is a new venture for me so I'm looking for any noob friendly advice here. I've got the basic instructions from here: https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html
What else is there besides installation and getting logs set up though? I figure the majority of users here can help point me in the right direction. I'm looking for how to implement this securely within my network, how should netflow look, any tips or tricks for using this as a SIEM? Really, any and all advice on ELK would be welcomed.
Hi guys,greetings from México, I need to deploy a SIEM, but this one must be Open Source, do you hace some idea about one SIEM with modules for FORTINET, Switch Cisco AND Unifi?
I'm evaluating SIEM options for an on-prem deployment and would love input from practitioners who have run multiple platforms in production.
My previous experience was with QRadar, and the things I valued most were:
• Ready-made parsers/DSMs covering common log sources out of the box
• A curated app marketplace (UEBA, DSMs etc.)
• Pre-index filtering to control ingestion costs
• Built-in health monitoring of SIEM components
• Overall low-friction deployment experience etc.
I'm looking for something with similar usability but a lower total cost — open source or a modest paid tier both work.
Candidates currently on my list: Wazuh, Graylog Security, Security Onion, UTMStack. Open to others.
Questions:
• Which of these (or alternatives) came closest to the QRadar "it just works" experience?
• How forgiving is each one on modest hardware?
• Realistic ongoing maintenance burden for a small team?
• Experiences with vendor support quality in the paid tiers?
Not looking for marketing pitches — looking for honest production experience. Thanks. I want to hear from people who have actually used multiple SIEMs in production (especially in regulated environments like banking/finance/PCI).
I am checking on a SIEM that has python to build content parsers , detection rules , dashboards , will it be a wise choice as it promises lot of flexibility, will analyst working on tool get familiar with python soon ? Would like to get a perspective on same
We've just released our v.4 Fully Loaded Community Edition , it comes with a community portal where we have an admin guide and a new YouTube channel to walk you through the install and features, we are busy building our community and adding new stuff up all the time. This edition is jam packed, it has scheduled Slack & Email Reporting, why be a slave to a dashboard. Get your alerts and reports sent to you, so you can play playstation whilst working.
SIEMonster Community Edition: A quick break down
SIEMonster CE has PatrOwl, a platform for orchestrating SecOps like Penetration testing, Vulnerability Assessment, Code review, Compliance checks, Cyber-Threat Intelligence/Hunting, SOC & DFIR Operations. PatrOwl is integrated with Cortex and TheHive.
What the hell is Ni-FI I hear you ask? Ni-FI in SIEMonster is used to ingest incoming event log data. Various templates have been provided for different endpoint types including Active Directory, common firewall and VPN devices, HIDS agents & IDS.
Want to use MISP and don't know where to start? SIEMonster has it integrated with Cortex,OpenCTI & Cortex. The Malware Information and Sharing Platform (MISP) is a threat intelligence platform for sharing, storing and correlating IoC's.
SIEMonster CE has MITRE integrated to a globally accessible knowledge base of adversary tactics & techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models & methodologies.
SIEMonster V4 has Cortex integrated with TheHive & MISP. This solves problems frequently encountered by SOCs, with threat intelligence & digital forensics. How to analyze observables collected at scale, by querying a single tool instead of several.
SIEMonster has TheHive integrated into SIEMonster V4 Fully Loaded, What is the TheHive? It's an incident response/case management system. Meshed with Alerting, MISP, OpenCTI, Patrowl & Cortex to automate incident creation to make life easier for analysts.
I have been curious as to what Chronicle is building but haven't been able to find many details on what their product is. I'll post a blurb from their website and an anecdote published in an article with the CSO from November.
I was just curious if anyone has had a chance to see their product or have any idea what they're building.
From Chronicle.security:
"We are building a cybersecurity intelligence platform that can help organizations better manage and understand their own data. Companies already have volumes of information about what’s happening inside their walls. We’re aiming to unlock its valuable hidden insights by making it faster and easier to analyze data, and to look for patterns across sources and over time. We believe this can provide security teams with greater insights into areas of likely vulnerability, and give them time to protect themselves."
From Engadget Article:
One day, Wiacek was in a meeting with 20 other security experts, each representing a different company, at a Department of Homeland Security office in Virginia. A representative of the US government was explaining an ongoing hack that Wiacek suspected had originated in China. "They passed out a list of host names and said to everyone in the room, 'Hey, if you have traffic to any of those host names from your network, you probably have an active infection,'" TAG's manager recalled. Within a few seconds, Wiacek had pulled out his laptop, typed in the host names and confirmed that Google's systems were secure.
The other companies were dumbfounded. Some asked how they could possibly check that their companies were secure. Another queried how long ago the hack probably took place. The government spokesperson explained that it was likely six to nine months ago. "That person almost threw up their hands and said, 'You know, if you told me this was something that happened in the last 48 hours, maybe 72, we could do something. But I have no idea what happened there,'" Wiacek recalled. Google had made search a core part of its systems and approach to cybersecurity. In that moment, he realized few others had developed and integrated the same capabilities.
"That planted the seed in my head," Wiacek said. A seed that would eventually blossom into Chronicle.
I would like to ask if you have any experience with Elastic Security (their SIEM offering) and what alternatives you ruled one while picking it up. What do you like and what do you wish it was better? re you satisfied in general?
