Re: Log Management

[Christopher Jones <Christopher.Jones () UFV CA>]

Hi Stanley,
 
We recently implemented RSA enVision as our SIEM solution.  One of the key features is that it doesn't normalize log 
messages, but keeps them in their native raw format.  It also has a sophisticated analysis and correlation engine.  
Were still in the process of fine tuning it, but so far so good.  Feel free to contact me offline if you would like 
more information.
 
Christopher Jones
IT Security Administrator
University of the Fraser Valley
Christopher.Jones () ufv ca 


> > > "Hammond, Stanley" <shammond () CAPECOD EDU> 03/05/2010 7:11 AM >>>
I am looking to see what other institutions are using to manage their
event/system log files.  

Currently I have Snare installed on our Windows servers and sending the
events to a syslog server.  That server originally had Prelude IDS
installed and I was using Prewikka to view the logs as needed.  The
problem with Prelude IDS/Prewikka is that accessing the database is
painfully slow unless you purchase the database module for fast access.
The other option I tested was Splunk which I liked, but because it
access Windows systems using WMI it looked like the some of the Windows
virtual machines took a performance hit (according to our Technical
Director).  Right now, I query the logs on the syslog server using
customized Perl scripts whenever an information request is made.  We are
making some changes to our environment and would like to get something
setup that is a little better than using Perl scripts on the CLI.  

Stanley M. Hammond
Information Security Specialist
Cape Cod Community College
Email: shammond () capecod edu