All,
I have discovered over the past few months that the TPM crashes
consistently, that when it does work it doesn't do much with Cisco PIX
logs, and that Fusion does nothing with the paltry data that the TPM
will process. Now we see ISS confirm this. Why haven't we seen
support for the TPM? My guess is that the TPM was a pet project that
fell out of favor when someone pointed out it that either SiteProtector
was going to have to go full tilt towards SIM-ness or stick to their
core competence. (Disclaimer: this is pure speculation on my part.
Flaming emails will be sent to /dev/null)
I have also reached the same point as Sergey raised last month in
regards to database management (see "DB backups and offline access").
When using SNORT I could easily maintain an "online" database of one
month's worth of data, and an "offline" database of 6 months of
archival data. As RealSecureDB grows, not only will we encounter a
performance hit, but the backup dilemma looms large (disk space,
increasing backup time, expanding backup windows impacting other backup
jobs.....)
Combine these two issues, and Stephen Cooper's advice looks good: buy a
SIM.
So here's the question: anyone using a SIM with ISS? If so, which one?
Jason Baeder
CISSP, GCIA
--- Sergey V Soldatov <SVSoldatov@tnk.ru> wrote:
If you'll take FusionFAQ_v2.0.pdf, you'll find:
8. Will the Security Fusion Module correlate third party data?
The Security Fusion Module currently will only correlate events
that are
being inserted into the SiteProtector Database. For the Security
Fusion
Module to be able to automate the correlation of events from a
sensor the
SiteProtector database must be able to accept the data. As
SiteProtector
adds the ability to collect third party data, the Security Fusion
Module
will begin to determine how to automate the correlation of that data.
Does it mean that in case of Third Party Module (TPM) usage Fusion
Module
will correlate events for Cisco PIX and Checkpoint FW1 as this FWs
are
supported by TPM? As I have undestood using TPM, Fusion Module does
not
correlate Cisco PIX's events came via TPM into SiteProtector DB. So,
Fusion
correlates not all events "that are being inserted into the
SiteProtector
Database", but only events from RNEs, RSVs and NSBs and this should
be
noted exactly in Fusion FAQ.
Connected another question is: does ISS plan continue to support TPM
in
future? During my TPM usage I don't remmember any XPUs for it...
Thank you.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
"Kaylor, Adrian \(ISS
Atlanta\)" To: "Pascual
Perez" <pascualperez@gmail.com>,
<AKaylor@iss.net>
"issforum@atla-mm1.iss.net" <issforum@iss.net>
Sent by: cc:
issforum-bounces@iss.net Subject: RE:
[ISSForum] Fusion module and checkpoint+cisco
08.03.2005 17:54
There are currently no correlation items for Fusion for CheckPoint or
Cisco
logs.
Thank you,
Adrian Kaylor, CISSP
Technical Product Manager
Internet Security Systems
Phone: (404) 236-3052
-----Original Message-----
From: issforum-bounces@atla-mm1.iss.net On Behalf Of Pascual Perez
Sent: Monday, March 07, 2005 5:38 PM
To: issforum@atla-mm1.iss.net
Subject: [ISSForum] Fusion module and checkpoint+cisco
hi, can Fusion Module integrate the correlation with Checkpoint FW1
and
CISCO logs?and how?
thanks in Advance
Pascual Alberto Pirez del Real
Azertia Consulting
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
__________________________________
Do you Yahoo!?
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
