Network Security Blog

Andy, IT Guy gives a specific example of how monitoring logs would have saved one company he consulted at a lot of time and grief.  The only problem is, in most organizations, log monitoring is an afterthought, if it’s a thought at all.  My last job was as the administrator of the IDS systems for a major state agency, and as such I spent my day monitoring Snort (later Sourcefire) logs for suspicious incidents, but most IT departments don’t have the luxury of dedicating a specific resource to that type of monitoring. 

If you have to monitor logs, find some way of aggragating and filtering your logs.  There are a number of open source and commercial solutions that will allow you to do both with varying degrees of implementation and daily usage pain.  But even a central syslog collector you can review through grep commands is better than having to go to each of the systems individually.  I’m looking at a Cisco Security Monitoring, Analysis and Response System (CS-MARS) implementation early next year, but your needs may be equally well served with a collection of open source tools you put together yourself. 

Anything’s better than not looking at the logs at all.

Trackback URI | Comments RSS