Penetration Testing mailing list archives
RE: Data Mining for PIX Firewall Logs
From: "Todd Towles" <toddtowles () brookshires com>
Date: Fri, 11 Feb 2005 09:23:57 -0600
Php-Syslog-ng worked pretty well, when I tested it. Think about using Stunnel also for moving the logs across the network in a secure channel.
-----Original Message----- From: jkowall [mailto:jkowall () shocking net] Sent: Wednesday, February 09, 2005 8:48 PM To: Carey Heck Cc: pen-test () securityfocus com; bugtraq () securityfocus com Subject: Re: Data Mining for PIX Firewall Logs First you will have to log the data via syslog. I reccomend kiwi syslog daemon for windows. The pro version is cheap and it can do compression, rotation, and filtering. It can also do email based alerting. Syslog-ng for*NIX is by far the most extensable and advanced daemon for *NIX. Now that you have the files, I would reccomend the following products: http://www.sawmill.net/ Sawmill not only processes PIX easily, but it can also process anything from sendmail, to IIS logs. Its a great tool. Well priced, and processes hundreds and hundreds of different logfiles. http://www.surfstats.com/sla_pro.asp Decent product, haven't used it much http://www.softland.com.ar/info/eiqnetworks/firewallan/submain.htm Expensive last time I looked, never used it. http://tud.at/programm/fwanalog/ Free logfile processor, the reports are pretty basic. http://perlmonks.thepen.com/123707.html Script to monitor a log and page/email. http://www.itefix.no/phpws/index.php?module=pagemaster&PAGE_us er_op=view_page&PAGE_id=21&MMN_position=21:21 Never used this one/ There are a couple other ones too, but these are some of the main ones. good luck, email with any additional questions. -jk Carey Heck wrote:Hi folks. I love the ability in the Checkpoint firewalllogging appletthat allows me to load up any former saved log file, and filter according to any criteria I set. Lets use an example: I want to show an auditor what exactly went through my firewall, to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on July 8th, 2003. In checkpoint, if I had correctly configured my ruleset, andarchivedmy log files properly, I could provide this answer within 30 minutes. Fast forward to my current company, which went with a Cisco PIX solution based on the up front cost. I can log all theconnections tomy heart content, but boy mining the data to help show whathappened inmy above example has been tiresome at best. Can anyone here please suggest to me some type of logging and more relevantly, a data mining product that can help me achieve this end? Currently I am logging all my PIX traffic to a host runningKiwi syslogdaemon, which archives each days logs into a separate folder in the dated logs directory, creating a new directory named foreach date inthe year. I am looking for a less clunky solution. Any help is GREATLY appreciated. Thanks!
Current thread:
- Data Mining for PIX Firewall Logs Carey Heck (Feb 09)
- Re: Data Mining for PIX Firewall Logs jkowall (Feb 11)
- RE: Data Mining for PIX Firewall Logs Jerry Shenk (Feb 11)
- RE: Data Mining for PIX Firewall Logs Carey Heck (Feb 11)
- Re: Data Mining for PIX Firewall Logs Michael J McCafferty (Feb 11)
- Message not available
- Re: Data Mining for PIX Firewall Logs Michael J McCafferty (Feb 21)
- Message not available
- <Possible follow-ups>
- Re: Data Mining for PIX Firewall Logs Cesar Diaz (Feb 11)
- RE: Data Mining for PIX Firewall Logs mhuston (Feb 11)
- Re: Data Mining for PIX Firewall Logs dijit (Feb 11)
- RE: Data Mining for PIX Firewall Logs Todd Towles (Feb 11)
- RE: Data Mining for PIX Firewall Logs Hill, Keith (Contractor) (Feb 11)