OSSIM leverages the power of the AlienVault Open Threat Exchange by allowing users to both contribute and receive real-time information about malicious hosts. AlienVault OSSIM is an open source Security Information and Event Management (SIEM) product. It is a unified platform providing: Asset discovery Vulnerability assessment Intrusion detection Behavioral monitoring SIEM OSSIM provides the basis for AlienVault's proprietary Unified Security…
N/A
Pentaho
Score 7.5 out of 10
N/A
Pentaho is a suite of open source business intelligence and analytics products, now offered and supported by Hitachi Data Systems since the June 2015 acquisition.
If this is your first experience with a SIEM, this one can get you started. Take the time to learn the ins and outs of the product and you'll most likely be satisfied with it if your company is an SMB. If you need compliance reports, OSSIM is too small for you, you'll need to go with USM or USM Anywhere.
Pentaho is very well suited to perform data extraction & data mining from various cloud storage & transform that data using various available data models. However, the software struggles when it comes to visualizing the extracted data in an appealing manner & can be difficult for end-users to get an understanding of data tables created using those models.
Asset discovery. Once installed in a centric, network-accessible server, OSSIM can poll all your endpoints with common protocols (SSH, SNMP, WMI) to detect and discover site-wide assets to monitor. You only need to group them by your own criteria once added to the product.
SIEM Event Correlation. You can define quite complex correlation rules to detect possible suspicious or malicious actions or attempts in your network, in order to categorize them as real threats or as false positives, thus streamlining your risk assessment and management.
Ease of installation. The entire AlienVault OSSIM is self-contained in an ISO file, which can be burned into a DVD or just mounted in your server of choice (physical or virtual) for deployment. The installation process is automated and quote verbosed, with options for static IP, email messaging and others.
Ease of access. Being AlienVault OSSIM a self-contained appliance, it can be accessed via web by any device that supports a web browser, being that desktops, workstation, mobile devices, etc. The OSSIM dashboard and other features are automatically rearranged to adapt to the particular device being in use.
I think the relative obscurity of the tool is a downside, not as many developers, consultants or peers you can tap into.
Lack of a solid user community held us back, looking at Power BI and Qlik, they have huge user communities that help each other out. Would have liked that here.
Smaller company means smaller sales force, and the lack of a local presence made it hard to only interact online with the account rep. Other companies have someone local who often stops by with pre-sales developers to just pitch in free of charge when they have time.
I will use Pentaho until I find a better tool with a better, easier to use report designer client. For now, Pentaho has been the most powerful reporting tool for our clients because of its ability to connect to Odoo, integrate in Odoo (reports are accessible in Odoo) and the flexibility in report design and parameter integration
AlienVault OSSIM is far easy to use and manage - provided you know what you're doing. As any SIEM application, there is some background knowledge required in order to take advantage of the product's functionalities, such as the log correlation and analysis. Other than that, the application is quite usable and robust.
The Pentaho tools are designed so you can start playing around on your own. Of course, you will need guidance at some point, but the training teams are good at guiding new users, and the online documentation is usually pretty up-to-date.
Some of the tools, such as the Pentaho Data Integration tool and the Pentaho Server, are pretty self-explanatory. The other tools maybe are not so quickly and obvious to use, but again, with some documentation and some customer support, you can find your way around them.
Everything is done through MSSP and installation pro services. Once those hours are burned up, then you're on your own without a lot of help. Typically the pro services hours aren't enough to get past 60 days and MSSP are hit and miss. We had a miss for installation helpers.
They were responsive to our questions when we raised issues. They gave us workarounds when required. They were quite knowledgeable when it came to issue analysis and providing fixes. They were forthright in informing us if a bug was not due for release soon.
Course Taken: DI1000 Pentaho Data Integration Fundamentals Setup A week before your class started, the instructor will start sending out class material and lab setup instructions. This is helpful so that you understand how the environment is laid out and can start reviewing the content. Ultimately it saved about a 1/2 day trying to setup with 10 other people online which was great! The Course The 3-day course was laid out like many other technical classes with 15-30 minutes instruction and 15-60 minutes of lab exercises. The instructor was very knowledgeable with the functionality from version to version and answered questions as we went along. I was amazed at some of the functionality that was available that I was not using at the time and quickly implemented changes to many existing transformations and jobs. The novice users seemed to catch on quickly and more experienced users explained how some of the functionality was used in their home environments. Towards the end there was enough time so that we were able to ask very directed questions about our own environments. Overall, I really found the class to be informative and deliver enough information to be dangerous. My skills improved and I was able to design better and efficient transformations for the HIE. Course Description: https://training.pentaho.com/instructor-led-training/pentaho-data-integration-fundamentals-di1000
Get the right people in before starting implementation. Start small and build as you go approach is time consuming and involves lot of rework. Evangalize within the organization the capabilities and limitations equally so that correct delivery expectations are set. Set expectations with the Customer that the tool cannot replace proprietary software in terms of stability/usability and that timelines could change given the new ness of the product.
Originally my organization leveraged alien value due to the lower cost of entry and ability to manage it as a service provider. Unfortunately, after several years of working with this tool, it became unwieldy to use as it felt that almost every useful report had to be created by hand. As other tools have come out with the ability to do automated responses such as Stellar Data processor, we have begun to evaluate alternatives.
Since the Pentaho platform offers a range of broad functionality across data preparation and advanced analytics, it also can be easily integrated to support many data sources and machine-learning frameworks. Based on that fact, we selected Pentaho to be used in our internal department. It also supports many of our BI use cases as required by company management or the business user. Last but not least, the Pentaho license is cheaper than their competitor.
