Network Intrusion Detection, Cyber Threats, Advanced Persistent Threats (APTs), Polymorphic Malware, Event Correlation – today all of these terms are foremost on many IT Security Professionals minds. What cyber security layer can we add to our existing protection efforts that will bring us greater peace of mind? Read more »

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

IT professionals have been looking for better ways to monitor and store firewall logs for years. Properly handled, firewall events can give insight into APTs, DoS attacks, firewall rule planning and misconfigurations, policy violations, and much more. To date, Syslog has been the go-to mechanism for access to firewall log info. It’s universally supported by the firewall community, easy to understand, and it’s quick to implement on both the firewall as well as the syslog analyzer.

Unfortunately syslog is resource intensive on both the firewall and the log analyzer. It’s largely unstructured, requires string pattern matching, and the exact format and fields vary from one firewall to the next. How often do you turn on full “Accept” and “Deny” logging for every rule? Sure you can and yes it’s valuable but the amount of syslog created is tremendous.

Enter NetFlow and IPFIX…

Read more »

This is a conversation I find myself having more and more lately so I thought it would make sense to discuss in detail just exactly how security information management systems (SIEMs) and NetFlow are related and why SIEMs are a poor choice for NetFlow collection.

Read more »

OK, let’s say you’ve decided to live a healthier life. You’re exercising regularly, stopped getting drunk every night, and you’re eating healthy. You’ve been eating more salads, almost cut out red meat, and even eating annoyingly healthy desserts, if any. Read more »

For a free 30 day trial of Scrutinizer, Download Now!

Sign up for Advanced NetFlow Training™ coming to a city near you!

Are you getting a lot of syslogs and want to filter what you are being alerted on?

Logalot, a Centralized Log Management application, has policy management features that allow you to filter on the incoming logs and alert based on the type, the number, or content of the logs.

For this blog post, I will be focusing on the triggers for sending alerts based on the number of incoming logs.

Read more »