Re: [Blind-sysadmins] Accessibility of certain security and monitoring products

I came upon this message as I was going through email and thought I'd follow up. Nessus: latest version uses html5 for UI, UI is accessible, most/all functions also available via REST API MARS: UI is accessible but rather clunky to use, product is EOL soon. HP ArcSight: web client and Java client both have accessibility issues, VPATs (available from HP) provide more information. NfSen: web frontend is accessible, generated graphs aren't usable as far as I can tell, data can be queried with command-line nfdump tool which works well. TippingPoint SMS: uses CLI for configuration. Chris On Mon, Aug 04, 2014 at 06:30:27PM -0500, Chris Nestrud wrote:

Hi Scott,

Thank you; that is encouraging news.

Chris

-----Original Message----- From: Blind-sysadmins [mailto:blind-sysadmins-bounces@lists.hodgsonfamily.org] On Behalf Of Scott Granados Sent: Monday, August 04, 2014 8:23 AM To: Blind sysadmins list Subject: Re: [Blind-sysadmins] Accessibility of certain security and monitoring products

Hi Chris, I can help you out with a few of these.

NFSen, very accessible, uses a simple web front end to nfdump to generate data. Basically the interface consists of a few buttons and some combo boxes where you set the parameters then you hit process and the output results in plain easy to read text tables. You pair this with nfdump which in itself is very scriptable and also provides text output to standard out. I just recently set up this environment for netflow collection across a large network so would be happy to get in to the nuts and bults of an install if you need some pointers.

NagIOS is another good accessible option. Has a web front end that delivers data like status as well as some configuration and uses perl or shell scripts for compiling data. You can also find tools based on NagIOS like open groundwork that are very accessible. Open NMS is another option along the same lines to look at.

I have found some of the vendor specific tools like the Juniper offerings to be java heavy and as such there are accessibility issues. In general though I've had very good luck with the open source tools both from a JFW and Mac accessibility perspective. Let me know if you have any further questions on the specific packages mentioned and I can dig in further if needed.

Thanks Scott

On Aug 3, 2014, at 12:38 PM, Chris Nestrud wrote:

...

Hello all,

I would appreciate comments from anyone who has used any of the following security-related products. I am particularly interested in their accessibility or lack thereof and any workarounds that you had to develop to get things done. Links included for the curious.

Nessus Scanner By Tenable:

http://www.tenable.com/products/nessus

Web interface works best using NVDA and Firefox; reports can be exported as csv.

Cisco Security Monitoring, Analysis, and Response System (MARS):

http://www.cisco.com/c/en/us/products/security/security-monitoring-analysis-

...

response-system/index.html

HP ArcSight SIEM:

http://www8.hp.com/us/en/software-solutions/siem-security-information-event-

...

management/

NfSen:

http://nfsen.sourceforge.net/

Unsure of accessibility; other CLI tools such as nfdump are available for intercepting and extracting netflow data.

TippingPoint Security Management System:

http://www8.hp.com/us/en/software-solutions/software.html?compURI=1344453#.U

...

95ick10yig

Nagios - The Industry Standard in IT Infrastructure Monitoring:

http://www.nagios.org

Uses Perl or shell scripts for plugins, unsure of accessibility of web interface.

Thanks in advance for any information,

Chris

_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins

_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins

_______________________________________________ Blind-sysadmins mailing list Blind-sysadmins@lists.hodgsonfamily.org http://lists.hodgsonfamily.org/listinfo/blind-sysadmins