RE: Data Mining for PIX Firewall Logs

From: Carey Heck (carey.heck_at_gmail.com)
Date: 02/10/05

  • Next message: Daniel Espinosa: "Evaluation SMTP Gateway." 
    Date: Thu, 10 Feb 2005 10:48:02 -0500
To: pen-test@securityfocus.com

    I just wanted to take a moment to thank everyone who replied to my
    initial email (albeit in the wrong list!) you have provided a wealth
    of information to get me hopping down the proper path.

    /salute

    Cheers!

    ---------- Forwarded message ----------
    From: Carey Heck <carey.heck@gmail.com>
    Date: Wed, 9 Feb 2005 17:08:59 -0500
    Subject: Data Mining for PIX Firewall Logs
    To: pen-test@securityfocus.com, bugtraq@securityfocus.com

    Hi folks. I love the ability in the Checkpoint firewall logging
    applet that allows me to load up any former saved log file, and filter
    according to any criteria I set.

    Lets use an example:

    I want to show an auditor what exactly went through my firewall,
    to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on
    July 8th, 2003.

    In checkpoint, if I had correctly configured my ruleset, and archived
    my log files properly, I could provide this answer within 30 minutes.

    Fast forward to my current company, which went with a Cisco PIX
    solution based on the up front cost. I can log all the connections to
    my heart content, but boy mining the data to help show what happened
    in my above example has been tiresome at best.

    Can anyone here please suggest to me some type of logging and more
    relevantly, a data mining product that can help me achieve this end?

    Currently I am logging all my PIX traffic to a host running Kiwi
    syslog daemon, which archives each days logs into a separate folder in
    the dated logs directory, creating a new directory named for each date
    in the year.

    I am looking for a less clunky solution.

    Any help is GREATLY appreciated.

    Thanks! 

    --
Carey
-- 
Carey
  • Next message: Daniel Espinosa: "Evaluation SMTP Gateway."

    Relevant Pages

    • RE: [fw-wiz] Log checking?
      ... tend to evaluate where and what logging is important in a different light. ... I've been happy to analyze a year's worth of firewall denied logs, ... have denied firewall traffic logs or denied logs with any relevant data. ...
      (Firewall-Wizards)
    • Re: Data Mining for PIX Firewall Logs
      ... Data Mining for PIX Firewall Logs ... > Can anyone here please suggest to me some type of logging and more ...
      (Pen-Test)
    • Re: [fw-wiz] Log checking?
      ... > While I've really enjoyed reading this communication regarding logging, ... > filter your logs to provide you with the information you need. ... > dropped by the internal interface on the firewall. ... were worm traffic on the standard microsoft file sharing ports. ...
      (Firewall-Wizards)
    • RE: [fw-wiz] pix firewall - failover and logging issues
      ... I have enabled logging level 7 on my PIX, ... I have not seen any performance degradation on the firewall side and my logs average about 300 MB a day! ... The first one is directed to failover users. ...
      (Firewall-Wizards)
    • Re: Advanced Reporting and Usage information.
      ... You may wish to investigate the Altair Technologies FireGen for PIX Log ... Firewall log analyzer developed by firewall administrators. ... administrator would take in analyzing firewall logs. ... The FireGen for PIX configuration analysis engine supports config files ...
      (comp.dcom.sys.cisco)
    • Quantcast