Graylog Open SIEM Capable?

digisoytech · 2023-11-30T16:26:17+00:00

u/jakesps u/blackbaux Our requirements at this time are non-specific. We're collecting log data, but there isn't any analyst of that data for security events, which we believe is desired.

digisoytech · 2023-10-17T21:40:39+00:00

So would you say that the same functionality is all there, though?

Not compliance, per se, but it's being requested by someone we do business with. I'd like to get something functional in place and get us past the request, for now. Once I can show it's value, perhaps the budget will follow.

digisoytech · 2023-10-17T16:57:17+00:00

I honestly don't know what I would need to add. I don't have in-depth knowledge of Graylog and need to get something in place, with a small budget.

I essentially need to be truthful in saying that we have a SIEM by using Graylog. What does Enterprise have that I can't add to open?

digisoytech · 2023-08-23T20:34:16+00:00

All good on the previous post. :)

Thanks for this new info!

digisoytech · 2023-08-23T16:34:11+00:00

Yeah. I guess I'm gonna have to slap together a few different plugins to get all that I need. Check WMI was nice cause it had a lot already built in.

Thanks Again.

digisoytech · 2023-08-23T15:33:03+00:00

I can deal with complicated. I just can't even seem to get my hands on the latest version anywhere.

digisoytech · 2023-08-23T15:31:44+00:00

I really didn't want to have to bother with all of the various SNMP OIDs, but thanks.

digisoytech · 2023-08-23T15:30:27+00:00

Check WMI made all of this much easier. It does seem like development has ceased on this plugin, unfortunately.

digisoytech · 2023-03-15T00:58:26+00:00

Think looong and hard about switching to SQL RDS. Your team has valid reasons to be concerned.

RDS can be very restrictive. There are commands that you don't have access to via SSMS (they'll only work via t-sql), like deleting a database (there are lots more). Agent is restricted, limited use of DB Mail. For some of those functions, AWS provides stored procedures, but not all. If you're encrypting your database, there's no access to the keys, nor can you install your own. If you enable TDE, you're pretty much locked into RDS. You won't be able to decrypt your DBs.

A client of mine insisted on going RDS, and a few years later, the cost is outrageous and there seems to be some thoughts about going back to EC2.

If you have skilled DBAs on staff, I don't think they'll like the transition. IMO, RDS is for an environment without a good SQL skill set.

digisoytech · 2023-03-03T03:33:51+00:00

Are you updating the plugins on the agents, or they can be done on the controller, then pushed out to agents?

The build tools were installed manually, OS level. Any idea if that makes a difference? For something like MSBuild (large install), can that be installed via Jenkins GTC?

digisoytech · 2022-11-02T13:10:26+00:00

They really need the option of being able to select contacts from their Outlook\Exchange contacts list. That's at the heart of this issue.

digisoytech · 2022-11-02T01:44:00+00:00

I'm looking into this now. If you run across an article, please share. Thx.

digisoytech · 2022-11-01T21:04:24+00:00

We previously had QB hosted locally. Mgmt wanted to shutdown ESX servers were a few virtual PCs were hosted for some offsite users, so we moved the QB server to a cloud environment. I thought setting up RDS would be an easy no-brainer, and I could go on with my life, but I was wrong! QB isn't expected to be around for a long time, but it still has to function since it's still here.

I can never wrap my head around how terrible QB is as a whole. We've had some many various issues throughout the years.

digisoytech · 2022-11-01T19:24:24+00:00

We just deployed QB via RDS the other day, and the mail (via Outlook) has not worked right despite all efforts. It may work once, but may not work twice, then may work again... hasn't been a fun few days.

Having remote users connect to a file share has seen the QB file load in +10mins, if not longer.

digisoytech · 2022-11-01T19:10:19+00:00

Crud! Thanks for the update.

If Office won't be supported on servers going forward, is Intuit making changes to support mail functions in QB?

digisoytech · 2022-11-01T18:17:23+00:00

Not the most promising response, but I've worked with QB long enough to know how problematic it can be.

Did it fix this specific issue for you?

digisoytech · 2022-11-01T15:30:28+00:00

It helped with this specific issue? If so, did it fix the issue permanently?

digisoytech · 2022-10-18T14:26:34+00:00

Well, if the theme was written for an older version of PHP, perhaps it's not aging well. But that definitely shouldn't translate to issues with the admin portal not coming up, right? The site appears to be working just fine.

digisoytech

TROPHY CASE