Re: Log Analysis -- Best Practice
Ron Gula <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
[email protected] wrote: > Hi All: > > I am looking for Best Practice information for Log Analysis. Is there > anyone who can help me out? > It really depends on what industry you are in and what sort of attacks and abuse you want to possibly log evidence from. I'm sure you will get a lot of ideas from list readers here. If you are just starting out ... - inventory of what you do have and start grabbing logs from those devices. - put some independent monitoring in place you should get also get some sort of network, netflow, IDS, IPS, NBAD and/or packet vault. The idea is that these logs are independent of any application or OS logs. If you have lots of logging and security monitoring already in place ... - try to align your organization's efforts around any of the PCI, NIST, health care, .etc compliance guides that are applicable for your organization. - check with your legal council to see if there are any corporate polices for logging, who is supposed to have access to these logs, what the retention policy is and so on. Don't be afraid to ask "why?" if a logging policy seems technically outdated. Ron Gula, CTO Tenable Network Security http://www.tenablesecurity.com http://blog.tenablesecurity.com