Best SIEM solution for small company?

Hi everyone,

Bear with me, because this will be kind of a ramble. I'm currently in my third year of my bachelors degree studying Information and Communication Technology (IT), following the Infrastructure/Networking profile with a specialization in Cyber Security, where I have been drawn to network security. Currently I'm at a "research" internship at a fairly small company, where everyone kind of takes care of everything if that makes sense, with kind of a hybrid network. My task is to write a research report where I basically advice them to get a certain SIEM solution. There aren't many requirements, but they would like it to be user-friendly, a tool that needs minimum maintenance and interference since they have to take care of a lot of other things too, and because of that also quite a high level of automation, and they don't have tons of budget. They wanted me to look into the following three SIEM solutions:

* Microsoft Sentinel
* Security Onion
* Checkmk




I added Wazuh and AlienVault OSSIM to that list myself. I figured out quite quickly that Checkmk isn't a SIEM since it lacks any threat detection features. Microsoft Sentinel seems quite nice and easy to use, and seems to need the least tweaking due to the AI and machine learning integration, and the fact that it's cloud-native is nice considering you don't have to deal with hardware. However, it will cost more than the open source alternatives most likely but could be reduced with the pay-as-you-go plan (I don't really have a clear image of the ingested possible ingested GB's of logs as of right now). Anyways, I'm quite impressed with Security Onion and Wazuh and it's features. Both seem really nice with a lot of features and presets (such as GDPR compliance for Wazuh) and are open source. I haven't really looked into OSSIM yet, but from reviews people seem to be kind of divided about it.

So, in the end, my question is, would Microsoft Sentinel be worth the costs in general over something like Wazuh or Security Onion for a small company? Or would something open source like Wazuh and Security Onion be fairly doable to install/manage after installation. I'd love to hear your experiences, since I'm still really new to all of this and have only worked with network monitoring tools in the past, but haven't used SIEM's yet.

Kind regards

(I'm sorry if I sound like I don't know what I'm talking about, I'm still learning haha. submitted by /u/Nexx0ne_
[link] [comments]


http://dlvr.it/T3jKLw