If you'll take FusionFAQ_v2.0.pdf, you'll find:
8. Will the Security Fusion Module correlate third party data?
The Security Fusion Module currently will only correlate events that are
being inserted into the SiteProtector Database. For the Security Fusion
Module to be able to automate the correlation of events from a sensor the
SiteProtector database must be able to accept the data. As SiteProtector
adds the ability to collect third party data, the Security Fusion Module
will begin to determine how to automate the correlation of that data.
Does it mean that in case of Third Party Module (TPM) usage Fusion Module
will correlate events for Cisco PIX and Checkpoint FW1 as this FWs are
supported by TPM? As I have undestood using TPM, Fusion Module does not
correlate Cisco PIX's events came via TPM into SiteProtector DB. So, Fusion
correlates not all events "that are being inserted into the SiteProtector
Database", but only events from RNEs, RSVs and NSBs and this should be
noted exactly in Fusion FAQ.
Connected another question is: does ISS plan continue to support TPM in
future? During my TPM usage I don't remmember any XPUs for it...
Thank you.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
"Kaylor, Adrian \(ISS
Atlanta\)" To: "Pascual Perez"
<pascualperez@gmail.com>,
<AKaylor@iss.net> "issforum@atla-mm1.iss.net"
<issforum@iss.net>
Sent by: cc:
issforum-bounces@iss.net Subject: RE: [ISSForum] Fusion
module and checkpoint+cisco
08.03.2005 17:54
There are currently no correlation items for Fusion for CheckPoint or Cisco
logs.
Thank you,
Adrian Kaylor, CISSP
Technical Product Manager
Internet Security Systems
Phone: (404) 236-3052
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Pascual Perez
Sent: Monday, March 07, 2005 5:38 PM
To: issforum@atla-mm1.iss.net
Subject: [ISSForum] Fusion module and checkpoint+cisco
hi, can Fusion Module integrate the correlation with Checkpoint FW1 and
CISCO logs?and how?
thanks in Advance
Pascual Alberto Pérez del Real
Azertia Consulting
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
