OSS product to replace CS-MARS
 

I'm looking for an open source solution to replace Cisco CS-MARS. MARS aggregates syslog data sent to it from remote devices and creates an attack mitigation plan that can then be applied to the devices. It can be used with servers, security appliances and network devices.

I had a brief look at snort, but that seems to function at the packet level and does not aggregate syslog data.

Does anyone have experience or maybe know of a product I should look at?

Thanks

Have a brief look at OSSIM or Prelude? If they are not completely what you require they at least might provide the framework to integrate things into.

OSSIM is looking promising.