After finishing the wave of research that covered pentesting, monitoring use cases, SOAR and TI, I’m excited to start research for a net new document covering an exciting topic rarely covered in Gartner research: Open source tools! The intent is to look at the most popular open source tools used by security operations teams out there. Things like the ELK stack, Osquery, MISP and Zeek. What I’d like to cover in this new paper is:
- Why is the tool being used? Why not a commercial alternative?
- How is it being used? What is the role of the tool in the overall security operations toolset, what are the integrations in place?
- How much effort was put to implement the tool? What about maintaining it?
- Is it just about using it or is there some active participation on the development of tool as well?
- What are requirements to get value from this tool? Skills? Anything specific in terms of infrastructure, or processes?
It is a fascinating topic, which bring a high risk of scope creep, so the lists of questions answered and tools covered are still quite fluid.
In the meantime, it would be nice to hear stories from the trenches; what are you using out there? Why? Was that picked just because it was free (I know, TCO, etc, but the software IS free….) ? Or is it a cultural aspect of your organization? Do you believe it is actually better than the commercial alternatives? Why?
Lots of questions indeed. Please help me provide some answers 🙂