RE : Data Mining for PIX Firewall Logs

From: MARTEAU Jean-Louis (jmarteau_at_ciments-calcia.fr)
Date: 02/11/05

  • Next message: Hill, Keith (Contractor): "RE: Data Mining for PIX Firewall Logs" 
    Date: Fri, 11 Feb 2005 16:27:00 +0100
To: <pen-test@securityfocus.com>

    I don't know is there's something to dig around
    Symantec DeepSight Threat Management System

    http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=158&EID=0

    Jean-Louis MARTEAU

    -----Message d'origine-----
    De : Cesar Diaz [mailto:cdiaz00@gmail.com]
    Envoyé : jeudi 10 février 2005 16:09
    À : pen-test@securityfocus.com
    Objet : Re: Data Mining for PIX Firewall Logs

    Carey,
     
    I am in the same boat with a Netscreen 25 firewall and am using the
    same clunky solution. The logfiles generated by Kiwi syslog are about 80
    MB, so opening up the text file is a challenge. Even Excel cant hadle
    the files because they exceed the allowable number of rows. The only
    way I've found to make mining the files easier is using PowerGrep, which
    gives you grep-like functionality under Windows and does allow for some
    use of regular expressions for searching.
     
    Please share any solutions you come up with for those of us in similar
    situations.
     
    Cesar Diaz

    Original Message____________________

    Carey Heck <carey.heck@gmail.com> wrote:
    Hi folks. I love the ability in the Checkpoint firewall logging
    applet that allows me to load up any former saved log file, and filter
    according to any criteria I set.

    Lets use an example:

    I want to show an auditor what exactly went through my firewall,
    to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on
    July 8th, 2003.

    In checkpoint, if I had correctly configured my ruleset, and archived
    my log files properly, I could provide this answer within 30 minutes.

    Fast forward to my current company, which went with a Cisco PIX
    solution based on the up front cost. I can log all the connections to
    my heart content, but boy mining the data to help show what happened
    in my above example has been tiresome at best.

    Can anyone here please suggest to me some type of logging and more
    relevantly, a data mining product that can help me achieve this end?

    Currently I am logging all my PIX traffic to a host running Kiwi
    syslog daemon, which archives each days logs into a separate folder in
    the dated logs directory, creating a new directory named for each date
    in the year.

    I am looking for a less clunky solution.

    Any help is GREATLY appreciated.

    Thanks! 

    -- 
Carey
  • Next message: Hill, Keith (Contractor): "RE: Data Mining for PIX Firewall Logs"

    Relevant Pages

    • Re: Strange WAN Activity
      ... > firewall logs for a possible TCP FIN scan that keeps ... > company's intranet server IP and its port 80 across our ... > My firewall is a Sonicwall Pro 200 and I'm running W2K ... It's difficult to be sure without inspecting the web server for signs of ...
      (microsoft.public.win2000.security)
    • Re: Winvnc hack! [25 KB]
      ... came in from a service such as IIS that logs IP address. ... Check your IIS ... Some firewall software such as ... You can also use the NETSTAT -A command that comes with Windows to look at ...
      (microsoft.public.win2000.security)
    • RE: [fw-wiz] Log checking?
      ... tend to evaluate where and what logging is important in a different light. ... I've been happy to analyze a year's worth of firewall denied logs, ... have denied firewall traffic logs or denied logs with any relevant data. ...
      (Firewall-Wizards)
    • Re: false portscan alarm
      ... What is the reason of that treffic? ... and the browser and/or the "personal firewall" had decided to close those ... which each have a local source port above 1024 opened outgoing to port 80 ... I've had a dig through my own PIX logs, and while there is nothing for today ...
      (comp.security.firewalls)
    • Re: SOHO firewall dropping incoming 443 connections - incorrect state
      ... I take it this sample snip of your logs is from a single session? ... client host connecting to the firewall was a single host. ... because of the nature of HTTPS requests it uses a different ephemeral ...
      (comp.security.firewalls)