Alex Scoble's IT Notes - An Information Technology Blog

A good starting point for researching Security Information and Event Management (SIEM) tools/services

Recently, I've been doing research on tools for log management and SIEM (Security Information and Event Management). As anyone who's ever been part of selecting an enterprise can testify, it's quite the daunting task.

Enterprise tools are BIG, as in they have a footprint larger than a brontasaurus, typically require a lot of work to get them set up to where they are useful and usable and they aren't any good unless someone (sometimes a small team is required) is managing them on a daily basis. Figuring out which tool best meets your needs is just as large of an endeavour.

Sometimes it can be hard to figure out just where to start, so you do some Google searches trying to find what SIEM tools are on the market, and maybe you do some searches for open source products that are up to the task and if you are lucky, you'll hit on one of Dr. Anton Chuvakin's blog posts on the subject.

He is definitely an expert in the field and currently works at Gartner doing analysis for them on the subject.

You'll also notice, if you pay close attention, that he's got a great sense of humor (and apparently likes Cognac).

Some notable blog posts of his that I think are required reading to anyone who is looking to purchase a SIEM tool are:

Top 10 criteria for a SIEM? - He goes against his better instincts and writes an informative blog post on excellent criteria, in my opinion, for beginning your assessments of the various SIEM tools

On choosing a SIEM - Here he provides some questions that a security analyst, business exec or IT manager should ask before they even begin looking for a SIEM...the questions are quite insightful and get to the heart of the matter of "do we really need this functionality?" and, more importantly, "do we have the resources to support it and make it successful?"

The myth of SIEM as "analyst in a box" - A good blog post in his series on how not to choose a SIEM. Basically, it boils down to if you don't have a security analyst or analysis team on staff already, you better get one before deploying a SIEM or your effort will be a complete failure.

Happy reading!

Feedburner's FeedFlare not showing ads on my blog

I wanted to add ads on each post of my blog here (that's apparently the best place for them) so looked for info on how to do it and came across this Typepad help page http://help.typepad.com/add_content_between_posts.html where it states "To place ads within posts without using Advanced Templates, you can use FeedBurner's FeedFlares feature to place Google AdSense ads within the post footer. Plus, Unlimited, Premium, and Business Class accounts have the ability to add FeedFlares to their blog. More information on setting up FeedFlares is available in the connecting to FeedBurner article."

I followed the thread and set everything up as Typepad, Google AdSense and Feedburner recommended. I saw that ads were now getting pumped to my feed, but not to my blog and it didn't matter what I did.

Members of the AdSense community help forum were very unhelpful and even a bit rude. I was hoping that a Google employee could verify if the functionality was still available or not and didn't get any such support.

I opened a support ticket with Typepad and they let me know that the links that I had used were probably out of date and that feature was likely no longer available.

So there you have it. If you have a Pro Basic Typepad account like I do, it's not currently possible for you to have ads on each blog post.

I finally got someone to blog!

Excerpted in toto from my Computerworld blog cuz Chris is da mayor of MonsterTech.

I've finally done it. Sort of. Gotten someone to blog.

Well OK, what I did was get my brother to get them to blog, but if A>B>C, then conversely, I got them to blog.

Talking about my best friend Chris Greene. Phenominal graphics design guy, uber-crazy mountain biker (he does 24 hour races and does them well to boot), consumer electronics guru (he's the reason why I'm completely sold on THX and will never go back) and amateur Looney Tunes voice guy (performs a mean Marvin The Martian if you are lucky enough to ever hear it).

Now he's working as an associate product category manager at Monster Cable. Whatever that title means, I don't think it comes close to conveying his area of responsibilities.

At any rate, at his request I got him and Robert Scoble (my brother) together to schedule Robert to speak about corporate blogging to Monster Cable.

Can't say yet whether the rest of the company will get on board, but Chris has started blogging and wrote this interesting piece on how the one of the two HDDVD camps (Blue Ray and HD-DVD) could run away with the game by simply offering their technology to companies with an open source license.

I don't see Sony or Toshiba doing this as they would lose all that licensing revenue. Plus they make a decent business out of selling the base parts for equipment such as CD and DVD players, although if they are able to manufacture the fundamental mechanisms for new HDDVD players at a better value than anyone else, they will still make profit doing it.

While you are checking that piece out you can also read my other piece from tonight: "Millions: What it can cost if you don't properly vet vendors".

Blogging jumped the shark? Blogs used as butt of joke on TV

OK, it's happened. A sitcom has used blogs as joke fodder.

On "How I met your mother", Neal Patrick Harris's (of Doogie Howser fame) character tells the Alyson Hannigan character about his silver and shiny shirt, "the similarity between women and fish is that both are attracted to shiny objects...Don't you read my blog?"

So it's happened...blogs have entered into prime-time TV in a joke.

At least it was a good one...or seemed so at the time.

Two new posts on my Computerworld blog

Two more posts have been put up on my Computerworld blog.

Click here to read about improving your company or firm by promoting better customer service.

This link will take you to a post on how to use "regular expressions" to do more advanced find and replace operations in MS Word.

Tonight's Computerworld roundup

Over on my Computerworld blog, I made two entries tonight.

One was on a new Google Group for blawgers, or those of us in the legal industry who blog. Could be another useful medium for all of us to find the best ways to utilize blogs for our firms and for our selves.

The second post was on some useful tools and tips for administering Windows and one link to a piece that could help you administer your empty stomach.

Jack Nickolson was right, some people can't handle the truth

My brother has been at the receiving end of a pretty malicious libel attack in an attempt to make him and Microsoft's upcoming Internet Explorer 7 look bad.

Wrote a bit about it on my Computerworld blog. Let's hope that the Register does more than just a slap on the wrist for the offending "journalist". Although, hack is probably a better term to describe the type of person that would do what he did. Liar is another one.

ComputerWorld Blogs Go Live

ComputerWorld.com went live with their blogs today. You can click here to get to them.

This is a good thing for IT people in general as they now have another source for information, but it's a pretty major thing for me as I am one of the "featured" bloggers on their site.

You can view my blog entries directly by clicking here.

Wonder if any A-Listers like Robert, Dave Winer or Joel Spolsky will notice and find this interesting.