[Dshield] SEIM Tool recomendation

[Duong, Henry M. (SHB)]

I recommend TriGeo.  Check out their site at www.trigeo.com.  I was
impress that as soon as I plug it in and configured, I was seeing things
that I didn't know existed.  It has help use track down some rogue
machines on the network and amongst other things.  The good news is you
won't get an arrogant sales guy and their tech support is really good.  

I spoke to ArcSight and they told me that our shop wasn't big enough for
them and they didn't want us as a customer, and that they only cater to
customers that have 100,000 users or more. Dimwits!!!  Now I have a
solution that is much better. 

-----Original Message-----
From: Albert Gonzalez [mailto:albertg at cerveau.us] 
Sent: Monday, February 04, 2008 12:15 PM
To: General DShield Discussion List
Subject: Re: [Dshield] SEIM Tool recomendation

Glad I worked with them when they were still a small shop. I always skip
the dog and pony show and *try* to get straight to eval. I haven't had
the pleasure of dealing with that ending. The SE region sales engineers
were coo.

-Albert 

--  Sent from my HTC6800
http://blog.cerveau.us 

-----Original Message-----
From: Jeff Stebelton <jeff.stebelton at gmail.com>
Sent: Monday, February 04, 2008 7:41 AM
To: 'General DShield Discussion List' <list at lists.dshield.org>
Subject: Re: [Dshield] SEIM Tool recomendation

The guy I worked with was even worse than that. The first fifteen
minutes of the very first call was a self-directed love fest towards
Arcsight with the rep telling me they don't take just ANYONE as
customers, and how many Fortune whatever customers they had. I got the
impression I was interviewing for the privilege of looking at their
product. Arcsight promptly got removed from our list for consideration,
and I deleted the arrogant, um, person's emails. 


Jeff

>... I too reviewed ArcSight and Cisco Mars. ArcSight was way too big 
>for
our shop and the sales guy I was working with did not even talk about
his product, rather he spent the time trashing others. 


_________________________________________
SANS Security 2008 in New Orleans!! January 11-19 2008. Why freeze up
north if you can be in New Orleans.  http://www.sans.org/info/15826





Mail Gate made the following annotations on Tue Feb 05 2008 09:29:16 
 
CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any, is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you.