TheHive VS lme

I had a quick test with the hive looks pretty nice. https://thehive-project.org/

Also look into hive. Lots of people are moving that direction. https://thehive-project.org/

TheHive is a versatile open-source solution for streamlining the investigation and prompt handling of security incidents. Seamlessly integrates with MISP to facilitate the transition from event analysis to investigation initiation, enabling efficient synchronization and export for collaborative threat detection and response. Moreover, coupling TheHive with Cortex empowers security professionals to efficiently analyze up to hundreds of observables. Timely-Lychee-5204 describes it as, "an open-source and scalable Security Incident Response Platform designed for handling incidents efficiently."

TheHive/Cortex - https://thehive-project.org/

i recommend TheHive for creating incident tickets. it is opensource but there is paid one offered by StrangeBee

Also unrelated to TheHive project, a security incident response tool.

https://thehive-project.org/

I haven't done any IR myself, but I was thinking something like TheHive Project (open source) or similar proprietary IR toolsets would be common. But over on r/blueteamsec I just saw this post, where people claimed to be using:

This may help https://github.com/ukncsc/lme/blob/master/docs/chapter2.md

But if you're still commited: there are too many variables to calculate it with any amount of certainty but you can measure it. Start off by setting up event forwarding on a small batch of test servers with only security audit logs included in the default configuration. Let it run for a few days and measure the usage and extrapolate from there. How to do most of it, you're going to find from MS documentation, but NCSC has a nice summary of it here: https://github.com/ukncsc/lme

Much appreciated. I'm a sole IT guy in a small shop so always keen to hear what others have found. I'm looking at: https://github.com/ukncsc/lme and Security Onion...

https://github.com/ukncsc/lme is this

Use something based off of a free version of Elasticsearch, like Logging Made Easy: https://github.com/ukncsc/lme or SIEMMonster or Security Onion.

Would also be repurposing sub to be a resource for Logging Made Easy, a community SIEM project by UKNCSC: https://github.com/ukncsc/lme