Please share about the SIEM systems you used before and how hard is it to learn?

• HomeLab

  1 19 4.2 PowerShell

I've used Splunk, QRadar, ELK, Graylog, and ArcSight. After using all of them over the past 9ish years I can tell you they aren't hard to learn/use. Each has its advantages and disadvantages, along with their quirks. I suggest pulling down a docker container of elk or splunk and trying them out. I'd also suggest trying out CyberWarDogs HELK project, simply because it's easy to set up. Here's a helpful script to get an endpoint (windows host) setup for testing. https://github.com/ValcanK/HomeLab/tree/main/Endpoint-HELK-Winlog-Sysmon-Atomic

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project