Re: FW/IPS log correlation software

["Olmstead, Frank M. - OTR" <olmsteadf () yahoo com>]

Just a clarification for this (Arcsight does a correlation before logs are send form agents or stored in database).

ArcSight does not do a correlation before hitting the manager/db it. ArcSight connectors can do filtering and 
aggregation prior to forwarding to the manager if that is desired.


----- Original Message ----
From: bart knippenberg <bartknippenberg () gmail com>
To: Raimar Melchior <raimar.melchior () crocodial de>
Cc: security-basics () securityfocus com
Sent: Friday, April 4, 2008 3:24:12 AM
Subject: Re: FW/IPS log correlation software

Hello Raimar,

Maybe you can take a look at RSA envision? This is at the moment
number one for Gartner. From technical point of view is this produkt
much better as Cisco Mars or Arcsight. Envision can correlate a hugh
amount of logs, has collectors for a lot of produkts, has a decent
Gui. Logs are not prefiltered when they are stored. (Arcsight does a
correlation before logs are send form agents or stored in database).

Best regards

Bart Knippenberg

2008/4/3 Raimar Melchior <raimar.melchior () crocodial de>:
> Hello list,
>
>  we want a central log station where logs from firewalls, ips and other
> security devices are sent to. All of our components support the syslog
> protocol.
>  The challange is to filter and correlate this huge amount of logs. We also
> want to create filtering and reports (graphical). The server should have a
> graphical frontend (gui).
>  We tried the kiwi syslog server but it doesn't meet our requirements. Any
> good enterprise software out there ?
>  Any suggestions would be very appreciated.
>
>  Many Thanks,
>  Raimar
>
>  Security Consultant
>
>  CROCODIAL IT Security GmbH
>
>  Niederlassung Köln
>  Von-der-Wettern-Str. 25
>  51149 Köln
>
>  office: +492203-69923-16
>  mobile: +49170-2265680
>  eMail: rm () crocodial de
>  http://www.crocodial.de/
>
>
>  Sitz der Gesellschaft: Hamburg
>  Eingetragen: Amtsgericht Hamburg Nr. HRB 83456
>  Geschäftsführung: Wolfgang Dierke, Helmut Hansen, Lutz Klöber
>
>  ----------------------------------------------------------------------
>  CROCODIAL SecurityDays 2008:
>  ----------------------------------------------------------------------
>   Berlin:      16.04.2008          Hamburg:     22.02.2008
>               26.09.2008                       05.09.2008
>   Bremen:      04.04.2008          Hannover:    18.04.2008
>               12.09.2008                       19.09.2008
>   Dortmund:    23.10.2008          Köln:        05.06.2008
>   Düsseldorf:  10.04.2008





      ____________________________________________________________________________________
You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost.  
http://tc.deals.yahoo.com/tc/blockbuster/text5.com