Re: SIM solution - Objectives ?
"saudi sans" <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
Hi Dave That is a very useful link. Does anyone know a similar resource for other Firewalls like Checkpoint and Stonegate which has the details of Audit logs - their details. This is basically for writing rules in my SIM software for filtering events-of-interest On 6/1/07, Dave Ellingsberg <[email protected]> wrote: > > > > - Changes to rulebase - However this seems impossible. People like > Checkpoint only say a new policy has been installed - They donot make > a log entry what change was made in the rulebase before ths install. > > I am yet to see any rulebase change logs in Firewalls like Netscreen > and CiscoPix which even captures that a rulebase has been installed or > what has been changed in the rulebase. > > > > *************** > > > 111008 > > Error Message %PIX-5-111008: User user executed the command string > > Explanation This syslog message is for accounting purposes. The user entered a command that modified the configuration. > > Recommended Action None required. > > more on what you can and do not log at http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemsgs.html > > bigfoot. >