[siem-users] IaaS/PaaS logs -> on-premise SIEM?

[Anton Chuvakin]

All,

First, Happy New Year!

As my attempt to wake up this esteemed list, here is a fun question, or,
rather, a whole bunch:

- do any of you (or others that you heard about) send logs from public
cloud IaaS instances (such as EC2) or even PaaS apps to your on-premise
SIEM?
- if yes, how's it working? what's the volume of data?
- if you don't do it, what do you think about such an approach in general?
will it work for large environments, in your opinion? is it future proof?

As you can see, I tried very hard to avoid leading questions (and avoided
mentioning SaaS log mgt / SIEM, flume, hadoop, etc, etc) since I am
genuinely curious....

Best,
-- 
Dr. Anton Chuvakin
Site: http://www.chuvakin.org
Twitter: @anton_chuvakin
Work: http://www.linkedin.com/in/chuvakin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://siemusers.org/pipermail/discussion_siemusers.org/attachments/20120104/06335a32/attachment.html>