July 2010 SIEM events

I can't wait to start the month on July. First the ArcSight Bootcamp in London and later the RSA Techfest in Boston.

Correlation opens the SIEM managed services needs

It has been very interesting follow up the blog traffic initiated with the loglogic announcement of price lowering of their SEM capability, specially the responses from Loglogic to the comments at visiblerisk and the post at Log Talk "Is correlation killing the Log Market?"

I'm agree that the vendors promise too much with the out-of-the-box rules, most of them need to be tunning in order to provide real value. And that's exactly the point! I don't think that Correlation is not good enough, it's just that the people using it lack of the skill/TIME necessary to actually get a good outcome.

Magic Quadrant for SIEM - May 2010

Finally i had time for reading the Gartner Magic Quadrant for SIEM (May 2010) and I'm not surprise that the 2 clear leaders continue being ArcSight and RSA(EMC) -I'm completely agree with it :P -

It's interesting to see how the primary driver continues to be regulatory compliance (80% North America SIEM market). Here in Norway I'd say it's even bigger, close to the 90%, especially PCI and its requirement for log management.