Re: FW/IPS log correlation software

[Albert Gonzalez <albertg () cerveau us>]

Bart,

ArcSight does not do correlation before events are sent to the manager.
Several operations are available at the SmartConnector (agent) level,
including:

    - Parsing
    - Filtering
    - Aggregation and/or BATCH operations.
    - RAW event

Since ArcSight uses a different connector for different data source it would
be hard to do correlation when the SmartConnector is only parsing/forwarding
checkpoint logs, etc... Without the ability of seeing the other data sources
being collected it cannot correlate against those events.

Thanks,

--
Albert Gonzalez, ACSA
http://www.cerveau.us/ || http://distributed.honeynets.org
"Success comes to the person who does today, what you are thinking of doing
tomorrow."


On 4/4/08 2:24 AM, "bart knippenberg" <bartknippenberg () gmail com> wrote:

> Hello Raimar,
>
> Maybe you can take a look at RSA envision? This is at the moment
> number one for Gartner. From technical point of view is this produkt
> much better as Cisco Mars or Arcsight. Envision can correlate a hugh
> amount of logs, has collectors for a lot of produkts, has a decent
> Gui. Logs are not prefiltered when they are stored. (Arcsight does a
> correlation before logs are send form agents or stored in database).
>
> Best regards
>
> Bart Knippenberg
>
> 2008/4/3 Raimar Melchior <raimar.melchior () crocodial de>:
> > Hello list,
> >
> >  we want a central log station where logs from firewalls, ips and other
> > security devices are sent to. All of our components support the syslog
> > protocol.
> >  The challange is to filter and correlate this huge amount of logs. We also
> > want to create filtering and reports (graphical). The server should have a
> > graphical frontend (gui).
> >  We tried the kiwi syslog server but it doesn't meet our requirements. Any
> > good enterprise software out there ?
> >  Any suggestions would be very appreciated.
> >
> >  Many Thanks,
> >  Raimar
> >
> >  Security Consultant
> >
> >  CROCODIAL IT Security GmbH
> >
> >  Niederlassung Köln
> >  Von-der-Wettern-Str. 25
> >  51149 Köln
> >
> >  office: +492203-69923-16
> >  mobile: +49170-2265680
> >  eMail: rm () crocodial de
> >  http://www.crocodial.de/
> >
> >
> >  Sitz der Gesellschaft: Hamburg
> >  Eingetragen: Amtsgericht Hamburg Nr. HRB 83456
> >  Geschäftsführung: Wolfgang Dierke, Helmut Hansen, Lutz Klöber
> >
> >  ----------------------------------------------------------------------
> >  CROCODIAL SecurityDays 2008:
> >  ----------------------------------------------------------------------
> >   Berlin:      16.04.2008          Hamburg:     22.02.2008
> >               26.09.2008                       05.09.2008
> >   Bremen:      04.04.2008          Hannover:    18.04.2008
> >               12.09.2008                       19.09.2008
> >   Dortmund:    23.10.2008          Köln:        05.06.2008
> >   Düsseldorf:  10.04.2008