From: dijit (tobkin@jaws.umn.edu)
Date: Thu Feb 10 2005 - 19:38:29 EST
Check out the new acquisition of Cisco's called Protego.
(http://www.protegonetworks.com/) It does all the stuff that Check
Point's log viewer does and event correlation and some basic attack
mitigation on top of that! It also accepts logs from plenty of other
types of devices (non-Cisco) as well.
Cheers,
// Chris
> -----Original Message-----
> From: Carey Heck [mailto:carey.heck@gmail.com]
> Sent: Wednesday, February 09, 2005 4:09 PM
> To: pen-test@securityfocus.com; bugtraq@securityfocus.com
> Subject: Data Mining for PIX Firewall Logs
>
> Hi folks. I love the ability in the Checkpoint firewall logging applet that
> allows me to load up any former saved log file, and filter according to any
> criteria I set.
>
> Lets use an example:
>
> I want to show an auditor what exactly went through my firewall, to/from a
> specific DMZ host, between the hours of 1 and 3pm GMT, on July 8th, 2003.
>
> In checkpoint, if I had correctly configured my ruleset, and archived my log
> files properly, I could provide this answer within 30 minutes.
>
> Fast forward to my current company, which went with a Cisco PIX solution
> based on the up front cost. I can log all the connections to my heart
> content, but boy mining the data to help show what happened in my above
> example has been tiresome at best.
>
> Can anyone here please suggest to me some type of logging and more
> relevantly, a data mining product that can help me achieve this end?
>
> Currently I am logging all my PIX traffic to a host running Kiwi syslog
> daemon, which archives each days logs into a separate folder in the dated
> logs directory, creating a new directory named for each date in the year.
>
> I am looking for a less clunky solution.
>
> Any help is GREATLY appreciated.
>
> Thanks!
>
> --
> Carey
>
>
>
>
--
*************************************************************************
Chris Tobkin tobkin@umn.edu
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
"I don't know how to teach. I'm a Professor."
Prof. Farnsworth to Fry, Futurama
*************************************************************************
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:16 EDT