Log Management

Syslog & Windows Event Log

Why log management?

Log Management - Pre-requisite to Ensure Network Security

Logs give you first hand information about your network activities. Log management ensures that the network activity data hidden in the logs is converted to meaningful, actionable security information. Log management is a pre-requisite for Network, Security administrator to keep the network secured.

Log management comprises of log collection, secured storage, normalization, analysis, reports and alerts generation.

Log Collection

  • Log collection needs to be unintrusive.
  • Logs need to be collected from diverse set of devices, servers and applications available in the network.
  • Log collection should be preferably without an agent. In some network environments, log collection using agent should be available optional.

Secured Storage

  • The log data needs to be stored in archive for forensic analysis and regulatory compliance requirements.
  • The log data storage should secured (e.g., encryption)
  • Also, the storage should be tamper proof
  • The retention duration should be flexible (preferably user configurable)
  • The storage location, media also should be flexible (read only media, mass storage system, etc.)

Log Normalization

The logs from heterogeneous sources should be normalized to have a common format. This is required to analyze and correlate.

Log Analysis

The logs need to be analyzed to get a full picture of the network security events

Report and Alert Generation

The logs are analyzed to generate reports and alerts

  • There should be canned, customizable, custom, and scheduled reports in different formats and distributable.
  • The alerts should be notified in real-time. There should be more notification mechanisms and even other program should be executed to carry out remedial measures

Log management is an integral part of monitoring network security

Customer Speaks
"Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application."
Jim Lloyd
Information Systems Manager
First Mountain Bank

EventLog Analyzer Trusted By

A Single Pane of Glass for Comprehensive Threat Management