SOPHOS XG and SIEM

Hi

Usually Free SIEM platform means limitation of GB / day of the logs it receives or the impossibility of enabling different log interpreters that SIEM can manage.

I would not want to disappoint you but SIEM Free does not exist , unlikely unless you do it for study, where the above limits can be ignored.

The use of SIEM is to be able to aggregate multiple log sources (Firewall, Windows, Linux, Antivirus, Office365, etc.) and through the knowledge of several "points of view" or "lists of dangerous IPs" and the combination / correlation of events seeks to increase the security of the systems.

Sometimes SIEM is used to do research on what happened maybe months before ...

Alienvault is a good SIEM ... but I recommend you take a look at SGBOX too.

Ciao!

Hello Anil Lutchman,

Thank you for reaching out to the community, for the query please refer the following useful KBA:

> Add a syslog server: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/SystemServices/LogSettings/SyslogServerAdd/index.html
> Cloud SIEM for Sophos XG Firewall: https://www.blumira.com/integration/sophos-xg-firewall/
> SIEM Integration in Sophos Central: https://www.youtube.com/watch?v=1MPwbfoIdBk