Posted by LorenDB 10/28/2024
[1] - https://www.ossec.net/
I run an in-house deployment using the Docker conf they supply. It requires a couple of hours per month and mainly a lot of disparate skills.
The real thing that takes time is the installation and configuration of the rules and agents. That’s something that you have to do for any SIEM really, irrespective of open source / paid: you have to understand your nominal feed and that takes time.
An agentless Nessus scan (man, I miss Nessus) gets you 90% of the way there for all but the most security-conscious organizations, and its agent is honestly kind of light and simple if I have to install it.
What's worse, Wazuh doesn't even fully replace any of those above agents, meaning it has to be yet another complimentary agent on the machine. No thanks, when New Relic + OpenTelemetry can feed me all of the machine's logs and monitoring statistics, while a competent ITAM/ITSM can alert on out-of-bounds posture and trigger network or Identity systems to shutdown access. Hell, I'm old enough to remember when basic log forwarding and SNMP traps were all that was needed to effectively monitor machines, before developers and vendors began locking stuff up behind new APIs or services they could monetize better.
Don't get me wrong, I want Wazuh to succeed because nobody should have to shell out thousands of dollars a month for basic security posturing and monitoring; right now though, Wazuh ain't it.
What was it specifically that made it a "maint burden of the first order?"
I have built from ground up 2 SIEMS.
Never had a single issue with indexes, though we only ingest 500k+ events per day for ~endpoints.
Don’t use email but notifications by Slack. Never had it fail in one year.
Honestly, I almost feel bad for the amount of value I’m getting for free. So I’m happy to give back: made an integration that recovers all Google Workdspace events (https://github.com/avanwouwe/wazuh-gworkspace) if anyone’s using Wazuh? I also plan on publishing my Chrome extension integration (behavioral analysis and malware and shadow it detection) in a couple of days!
What SIEM did you move to that was less of a burden?
I appreciate you.
Source? The value a SIEM provides these days is mostly the out of the box integrations and log parses. Wazuh is far from that, IME.
The maintenance is huge, you need to hunt for rulesets, the EDR is half baked, etc.
Guess IDC ABT this. Jokes aside, read the page, still don't know if I care about this or need it...
Clearly parent could have phrased it more explicitly that he knows nothing about this field. But I also see downvoting him as a form of gatekeeping.
"Universal agent" is some form of antivirus, ransomware software like ESET, or McAffee?
Or does the universal agent listen to "endpoint security, somebody elses antivirus that reports what it finds up the chain?
And the next step is that the data gets to the server, is parsed, stored etc and present on a nice gui?
"Someone proped computer3 with a known exsploit at (somedatetime)" ?
Does that then mean we can conclude that the agent that comes with this product is a fully fledged endpoint security like ESET/MCaffe etc?
I am wondering about this since a top notch free and open source antivirus and malware program would be super useful and cheap
If it were me, I would compare and contrast it's features and support with commercial offerings and see which one you feel the most comfortable with. There's a lot at stake when it comes to security. It's probably best not to let your decisions be 100% about up-front cost.