Re: Network flow log consolidation

[Wes Young <wcyoung () BUFFALO EDU>]

On Tue, 2006-04-25 at 15:00 -0500, Justin Dover wrote:
> Cisco MARS is VERY nice.  Especially if you have an entire Cisco
> infrastructure.  I hope to have one someday.  I have seen it in
> action.

It's ok... like I said, baseline correlation and trends. If you put it
side by side with arcsight, doesn't even come close.

If they put some cisco money into the product, maybe in 2-3 years it
will be a good competitor....maybe.
--
Wes Young
Network Security Analyst
University at Buffalo
 -----------------------------------------------
| My Security Blog: | http://tinyurl.com/9av4k  |
| My RSS:           | http://tinyurl.com/ceopv  |
| My Life:          | http://tinyurl.com/l18g   |
| CPAN:             | http://tinyurl.com/mujm5  |
 -----------------------------------------------