OSSEC + Palo-Alto OSSEC out of the box does not include any decoders or rules for Palo-Alto Networks Next-Generation firewalls. This is part 2 of PaloAlto firewall integration with OSSEC. Read part one to learn how to create the basic decoder, a threat decoder and rules. In this part we will …
OSSEC + Palo-Alto OSSEC currently does not include any decoders or rules for Palo-Alto Networks Next-Generation firewalls. I just happen to have access to one of these devices and wished to get some logs into OSSEC. A little search on the interwebs only turned up a single relevant link. Xavier …
Having just come back from the SANS 2013 Orlando security conference, I want to share some random thoughts. SANS Instructors and speakers are top rate (once again) The invited vendors were pertinent to the conference and added to the experience SANS @ Night and special conferences were very much worth it …
Having just come back from the SANS Institute Orlando security conference, I want to share some random thoughts. SANS Instructors and speakers are top rate The invited vendors were pertinent to the conference and added to the experience SANS @ Night and special conferences were very much worth it and provided up …
Black hole routing is now your friend. You are forwarding traffic not meant to be routed to a termination point on your network. Let’s look at some advanced ways to get more focused network security data from this traffic. For part 1, skip to the next post. Advanced network monitoring …
The average Network Administrator has control over all the tools to put in place effective black hole routing and reporting. The simple steps below should get you started and the prerequisites to getting there. Executive summary Static black routing and policy based black hole routing are great ways to securely …
How to use trending tools, like Cricket, Splunk or Cacti, to visualize the Active Directory event log. Time series trending provides a different perspective from the typical SIEM. It is also useful for capacity planning, security analysis and operations. First, getting Event log data to a trending tool AD Domain …
Making use of time series trending for network security monitoring. A short history with examples. Time series trending tools like: Cricket, Cacti and Torrus focus on performance and availability. Operational teams use these day in day out, the tools are there to organize and display reams of data in …