bugtraq - Data Mining for PIX Firewall Logs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6acb00fc05020914084fcccec@mail.gmail.com>
Date: Wed, 9 Feb 2005 17:08:59 -0500
From: Carey Heck <carey.heck@...il.com>
To: pen-test@...urityfocus.com, bugtraq@...urityfocus.com
Subject: Data Mining for PIX Firewall Logs

Hi folks.  I love the ability in the Checkpoint firewall logging
applet that allows me to load up any former saved log file, and filter
according to any criteria I set.

Lets use an example:

I want to show an auditor what exactly went through my firewall,
to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on
July 8th, 2003.

In checkpoint, if I had correctly configured my ruleset, and archived
my log files properly, I could provide this answer within 30 minutes.

Fast forward to my current company, which went with a Cisco PIX
solution based on the up front cost.  I can log all the connections to
my heart content, but boy mining the data to help show what happened
in my above example has been tiresome at best.

Can anyone here please suggest to me some type of logging and more
relevantly, a data mining product that can help me achieve this end?

Currently I am logging all my PIX traffic to a host running Kiwi
syslog daemon, which archives each days logs into a separate folder in
the dated logs directory, creating a new directory named for each date
in the year.

I am looking for a less clunky solution.

Any help is GREATLY appreciated.

Thanks!

-- 
Carey