RE: Correlation Tool

I agree with Robin, I like Arcsight.  It has some pretty broad application
across application logs, fw logs, ids logs, web logs, and supports snmp
reporting for health monitor checking.  Reports are pretty slick too.  And
if you're looking at true correlation, this is one of the best devices that
I've seen.  Albeit, a little pricy.
 
Another option is Network Intelligence.  Not a bad tool.
 
jm

-----Original Message-----
From: Adeduwon, Alex A [mailto:Alex.Adeduwon@opm.gov]
Sent: Tuesday, January 24, 2006 3:02 PM
To: 'firewalls@securityfocus.com'
Subject: Correlation Tool



Hello All,

 

Does anyone know of tool(s) very suitable for Fw and IDS logs correlation,
reporting and trending?  What I mean is this, if an environment has PIX
firewalls already configured with some custom logging like how many hits on
xyz ports, etc and they want to make meaningful data or report from those
types of statistics.  Or another scenario is to take a string from an IDS
alert/log and dump it for a meaningful output without having to manually
research and crack my brain as to what that alert means.

 

AAA

 



-------------------------------
-- Even though this E-Mail has been scanned and found clean of 
-- known viruses, OPM can not guarantee this message is virus free.
-------------------------------
-- This message was automatically generated.
-------------------------------ro