I work for an MSSP, and we are currently looking at expanding our Managed IDS offering. As part of this we are looking for a product that will collect and aggregate events from a large number of heterogenous event sources (if truly event generator agnostic, then even better) (both network and host sensors). In short, (some of) our requirements are that it can collect events, standardise their format and allow us to apply filtering *after* event collection (so it would necessarily have to support high volumes of data).
After collection, events need to be stored securely, and displayed to analysts in as good a way as possible (I am sure we all have our preferences here - I am partial to Sguil/Sguil-like displays). Now - to my question. We have looked at exaProtect, and it seems like a solid product which meets a majority of our requirements. I was wondering if anyone on the list have any experiences / opinions on exaProtect that they would like to share? Thanks in advance. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
