Guys, can you tell me how efficient and effective are these snort, argus, ossec etc etc for an organization having 3500 PC Network, connected through 700+ Cisco Devices (Layer 2 and Layer 3), and scattered on 130 different sites (geographically)??? what should be the combination of products and what should be the architecture for an efficient forensics activity???

saifkhan123, I've moved your post from where you originally posted to a new thread, as I believe it's an excellent candidate for its own dedicated discussion and it may have deviated from the main objective behind unixfool's thread.

They are really good open source tools for network/system monitoring. However, no matter how good the tool is, it's useless without a skilled analyst.

Just because you have a large network, it doesn't mean you have to monitor all of it. Some monitoring is better than none. You're going to need to determine which computers need monitoring the most and have the analysts to analyze all of the data the tools generate.

If I were you, I'd start off small and work my way up. For example, I wouldn't use Argus, I'd start with what you already have in place such as NetFlow enabled on select routers and use flow-tools for collecting and analysis of the flows. I've just started reading Network Flow Analysis which is pretty good so far. OSSEC Host-Based Intrusion Detection Guide is a good book on OSSEC, and Snort IDS and IPS Toolkit is a good book on Snort.

1 members found this post helpful.