A really nice utility that lets you do real-time analysis, reporting, and
alerting based on "live" syslog data is the eIQ Network Security Analyzer.
The cost is extremely low compared to other comparable featured products, if
you are looking at analyzing log data from one to just a handful of
firewalls. I know several of the large firewall vendors are now packaging
the eIQ products with their product for reporting purposes.
Scott Fuhriman
-----Original Message-----
From: Greg Clayton [mailto:ghclayton@gmail.com]
Sent: Monday, February 14, 2005 8:35 PM
To: Carey Heck
Cc: firewalls@securityfocus.com
Subject: Re: Data Mining for PIX Firewall Logs
Carey -
I am currently in the same situation... I have evaluated a few
products, but the best by far has been Sawmill (www.sawmill.net). The
product produces excellent reports from flat log files and it supports
formats from every conceivable platform. The product is really
outstanding; however, it does not take 'live' syslog data. If you can
send your syslog data to a flat file, you're in business. Other
potential log sources include FTP, HTTP, and command. I have not yet
attempted to use the other source types, as I only have log files to
work with. The product also includes both report filters and log
filters which allow you to fine tune your reports to only the data you
want to see. As indicated on the web site (and I can vouch for all of
the features), features include:
* Easy To Use
* Extensive Documentation
* Live Reports & Graphs
* Package of Powerful Analysis Tools
* Attractive Statistics
* Database Driven
* Advanced User Tracking by WebNibbler(tm)
* Very Fast
* Easy To Install
* Highly Configurable
* Works With a Variety of Platforms
* Processes Almost Any Log File
I was tasked with reporting on Q4 2004 logging and so far, Sawmill has
done the trick. You purchase the product by number of 'profiles'
(different log formats). Sawmill is very affordable (see pricing at
http://www.sawmill.net/us_pricing.html). I am currently evaluating
the Enterprise version and will most likely purchase very soon.
Let me know if you have any questions and I'll see if I can help out.
Good luck!
Greg Clayton
ghclayton@gmail.com
On Wed, 9 Feb 2005 20:59:56 -0500, Carey Heck <check@strasz.com> wrote:
Hi folks. I love the ability in the Checkpoint firewall logging
applet that allows me to load up any former saved log file, and filter
according to any criteria I set.
Lets use an example:
I want to show an auditor what exactly went through my firewall,
to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on
July 8th, 2003.
In checkpoint, if I had correctly configured my ruleset, and archived
my log files properly, I could provide this answer within 30 minutes.
Fast forward to my current company, which went with a Cisco PIX
solution based on the up front cost. I can log all the connections to
my heart content, but boy mining the data to help show what happened
in my above example has been tiresome at best.
Can anyone here please suggest to me some type of logging and more
relevantly, a data mining product that can help me achieve this end?
Currently I am logging all my PIX traffic to a host running Kiwi
syslog daemon, which archives each days logs into a separate folder in
the dated logs directory, creating a new directory named for each date
in the year.
I am looking for a less clunky solution.
Any help is GREATLY appreciated.
Thanks!
Carey
