Security Log Management: Identifying Patterns in the Chaos
- 4h 17m
- Jacob Babbin, et al.
- Elsevier Science and Technology Books, Inc.
- 2006
As a system administrator or security professionals, you probably find yourself inundated each day with a deluge of log files from seemingly countless devices, servers, and applications on your network ranging from Windows Server to Snort to your PIX firewall and everything in between. At times, the task of "seeing the forest through the trees" to extract useful, repeatable information from these logs may seem almost impossible. This unique book will show you how to use a combination of open source software such as Tcpdstats, and Snort perfmonitor to create succinct, meaningful reports that give you the big picture of your network's overall health and well being. So, if you need to analyze and prioritize everything from how much of your bandwidth is devoted to browsing ESPN.com, to the most targeted machines in your IDS logs, this is the book for you. This book teaches IT professionals how to analyze, manage, and automate their security log files to generate useful, repeatable information that can be use to make their networks more efficient and secure using primarily open source tools.
The book begins by discussing the "Top 10" security logs that every IT professional should be regularly analyzing. These 10 logs cover everything from the top workstations sending/receiving data through a firewall to the top targets of IDS alerts. The book then goes on to discuss the relevancy of all of this information. Next, the book describes how to script open source reporting tools like Tcpdstats to automatically correlate log files from the various network devices to the "Top 10" list. By doing so, the IT professional is instantly made aware of any critical vulnerabilities or serious degradation of network performance.
In this Book
-
Security Log Management—Identifying Patterns in the Chaos
-
Foreword
-
Log Analysis: Overall Issues
-
IDS Reporting
-
Firewall Reporting
-
Systems and Network Device Reporting
-
Creating a Reporting Infrastructure
-
Scalable Enterprise Solutions (ESM Deployments)
-
Managing Log Files with Microsoft Log Parser
-
Investigating Intrusions with Microsoft Log Parser
-
Managing Snort Alerts with Microsoft Log Parser
