Penetration Testing mailing list archives
RE : Data Mining for PIX Firewall Logs
From: "MARTEAU Jean-Louis" <jmarteau () ciments-calcia fr>
Date: Fri, 11 Feb 2005 16:27:00 +0100
I don't know is there's something to dig around Symantec DeepSight Threat Management System http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=158&EID=0 Jean-Louis MARTEAU -----Message d'origine----- De : Cesar Diaz [mailto:cdiaz00 () gmail com] Envoyé : jeudi 10 février 2005 16:09 À : pen-test () securityfocus com Objet : Re: Data Mining for PIX Firewall Logs Carey, I am in the same boat with a Netscreen 25 firewall and am using the same clunky solution. The logfiles generated by Kiwi syslog are about 80 MB, so opening up the text file is a challenge. Even Excel cant hadle the files because they exceed the allowable number of rows. The only way I've found to make mining the files easier is using PowerGrep, which gives you grep-like functionality under Windows and does allow for some use of regular expressions for searching. Please share any solutions you come up with for those of us in similar situations. Cesar Diaz Original Message____________________ Carey Heck <carey.heck () gmail com> wrote: Hi folks. I love the ability in the Checkpoint firewall logging applet that allows me to load up any former saved log file, and filter according to any criteria I set. Lets use an example: I want to show an auditor what exactly went through my firewall, to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on July 8th, 2003. In checkpoint, if I had correctly configured my ruleset, and archived my log files properly, I could provide this answer within 30 minutes. Fast forward to my current company, which went with a Cisco PIX solution based on the up front cost. I can log all the connections to my heart content, but boy mining the data to help show what happened in my above example has been tiresome at best. Can anyone here please suggest to me some type of logging and more relevantly, a data mining product that can help me achieve this end? Currently I am logging all my PIX traffic to a host running Kiwi syslog daemon, which archives each days logs into a separate folder in the dated logs directory, creating a new directory named for each date in the year. I am looking for a less clunky solution. Any help is GREATLY appreciated. Thanks! -- Carey
Current thread:
- RE : Data Mining for PIX Firewall Logs MARTEAU Jean-Louis (Feb 11)