Re: Correlation software

[Mike Lyman <mlyman-security () comcast net>]

On Thu, 2004-03-18 at 10:07, sam () neuroflux com wrote:
> Hello..  Thank you all for your responses to my Entercept email, they have
> all been fantastic!
>
> I am also looking to find out if there are any commercial Log Correlation
> packages available?  I'm looking for something that can correlate Firewall
> + IDS + HIDS type of logs and create a logical flow of events..
>
> Can anyone recommend, or point me in the right direction?

My standard answer to that is import to a database and start writing SQL
queries. Nothing will match the flexibility and once you get good at it,
you'll start finding things in your data you'll never find with other
tools.

SQL was one of the biggest required skills on the incident
response/intrusion detection team at my old job.

-- 
Mike Lyman <mlyman-security () comcast net>


---------------------------------------------------------------------------

---------------------------------------------------------------------------