Re: log monitoring/analysis/correlation systems

[Joseph Jenkins <maillist () breathe-underwater com>]

I am a huge fan of CS-MARS when you know how to use it you can make  
it do wonderful things.  Also the reporting/query engine is one of  
the best I have been exposed too.  I have used it at my last two  
companies and couldn't imaging running a network without.  Especially  
once it is coupled with SNARE you are able to pull in all of the log  
files from your Windows Machine.  With the custom log parsing ability  
I believe the options are endless.  Also if you use one the AV  
Vendors they support you can now report on all of your  
infrastructure.  Auditors like the reports that come out of Mars and  
the ability to archive them form email or off to a file server is a  
great advantage of the product.
On Nov 22, 2006, at 5:51 AM, vameg () aol com wrote:

> Symantec is just releasing SSIM 4.5 - worth a look because it  
> eliminates the database issue mentioned elsewhere, supports many  
> many different types of point products, and has powerful  
> correlation capabilities.
>
> ---------------------------------------------------------------------- 
> -----
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
> The NSA has designated Norwich University a center of Academic  
> Excellence
> in Information Security. Our program offers unparalleled Infosec  
> management
> education and the case study affords you unmatched consulting  
> experience.
> Using interactive e-Learning technology, you can earn this esteemed  
> degree,
> without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> ---------------------------------------------------------------------- 
> -----