topic Re: Firewall Log Analyzer in Network Security

Firewall Log Analyzer

yuchenglai — Mon, 11 Mar 2019 13:33:34 GMT

I was wondering if anyone has a recommendation on a good firewall log analyzer...that can analyze if there are attacks taking place, etc?

Re: Firewall Log Analyzer

dhananjoy chowdhury — Wed, 20 Aug 2008 14:50:59 GMT

You can try this

http://manageengine.adventnet.com/products/firewall/

Re: Firewall Log Analyzer

Farrukh Haroon — Wed, 20 Aug 2008 18:22:49 GMT

MARS would be the number one choice if your firewall is from Cisco. Juniper also has a SIM now. This is from a previous post:

Have you looked at Cisco MARS? (Its actaully a SEM)

http://www.cisco.com/en/US/products/ps6241/products_data_sheets_list.html

http://www.sawmill.net/features.html

(Found it to be pretty nice, but might be pricy)

If you want a real-time thing, fireplotter is pretty cool:

www.fireplotter.com

Alternates:

http://manageengine.adventnet.com/products/firewall/

(never tried it tough)

http://www.eventid.net/firegen/firegenpix2.asp

(had serious performance issues)

Some more:

http://www.windowsecurity.com/software/Firewall-security-log-analyzers/

Please rate if helpful

Regards

Farrukh

Re: Firewall Log Analyzer

yuchenglai — Wed, 20 Aug 2008 18:32:45 GMT

What is a SEM? I've seen Cisco MARS at a demonstration, but it just strikes me as pricey particularly when I know we will not be able to fully leverage its capabilities. I just need something that will analyze firewall logs for now. Will Cisco MARS allow incremental license purchases as needed?

Re: Firewall Log Analyzer

Farrukh Haroon — Wed, 20 Aug 2008 18:43:25 GMT

SEM = Security Event Management

SIM = Security Incident Management

STM = Security Threat Management (Cisco Marketing Word)

Cisco MARS is licensed on an EPS basis. EPS means Events per second. You can just go for the smallest model available. It is worth the price IMHO.

In ASA version 8.x there is a feature called threat detection, that might also help you in this regard.

Regards

Farrukh