Re: Correlation software

[Rainer Duffner <rainer () ultra-secure de>]

sam () neuroflux com wrote:

> Hello..  Thank you all for your responses to my Entercept email, they have
> all been fantastic!
>
>  

What I would be interested in knowing is:
For things like syslogs, firewall-logs etc. - they're not collected in a 
central console anyway (normally, without the correlation SW).
So you have some sort of agent that sucks them in, I suppose.

But what about an IDS and it's console ?
E.g. how is (attack-)information (in this case probably about an event 
that occured) from a Dragon sensor transported to a correlation-"sensor" 
(or agent) ?
I assume the dragon-server still receives it and thus it must be somehow 
"duplicated".



Anyone can shed light on this ? Or is this a silly question ?



Rainer



---------------------------------------------------------------------------

---------------------------------------------------------------------------