Logging and Reviewing Firewall Logs

[josepherdt]

Is there a heuristic for setting up an intrusion detection system with a Cisco ISR? We would like to utilize our firewall logs for an intrusion detection system.

[thomas.chen]

Following links may help you

http://www.cisco.com/en/US/products/ps6498/prod_release_note09186a00806186f0.html

http://www.cisco.com/en/US/products/ps6634/products_white_paper0900aecd8062acfb.shtml

[mhellman]

There are tools that will correlate firewall logs, if that's what you mean. To get you going, there's Cisco's own SIM product, MARS.

http://www.cisco.com/go/mars

There's the open source OSSIM: http://www.ossim.net/.

[attmidsteam]

Intellitactics NSM will cross correlate many device types including routers, firewalls, & sensors:

http://www.intellitactics.com/int/