Re: FW/IPS log correlation software

[Jay <jayvanguy () gmail com>]

Arcsight or NetForensics might be a good start


http://arcsight.com/

http://netforensics.com/


On 3-Apr-08, at 7:39 AM, Raimar Melchior wrote:

> Hello list,
>
> we want a central log station where logs from firewalls, ips and  
> other security devices are sent to. All of our components support  
> the syslog protocol.
> The challange is to filter and correlate this huge amount of logs.  
> We also want to create filtering and reports (graphical). The server  
> should have a graphical frontend (gui).
> We tried the kiwi syslog server but it doesn't meet our  
> requirements. Any good enterprise software out there ?
> Any suggestions would be very appreciated.
>
> Many Thanks,
> Raimar
>
> Security Consultant
>
> CROCODIAL IT Security GmbH
>
> Niederlassung Köln
> Von-der-Wettern-Str. 25
> 51149 Köln
>
> office: +492203-69923-16
> mobile: +49170-2265680
> eMail: rm () crocodial de
> http://www.crocodial.de/
>
>
> Sitz der Gesellschaft: Hamburg
> Eingetragen: Amtsgericht Hamburg Nr. HRB 83456
> Geschäftsführung: Wolfgang Dierke, Helmut Hansen, Lutz Klöber
>
> ----------------------------------------------------------------------
> CROCODIAL SecurityDays 2008:
> ----------------------------------------------------------------------
> Berlin:      16.04.2008          Hamburg:     22.02.2008
>              26.09.2008                       05.09.2008
> Bremen:      04.04.2008          Hannover:    18.04.2008
>              12.09.2008                       19.09.2008
> Dortmund:    23.10.2008          Köln:        05.06.2008
> Düsseldorf:  10.04.2008