Integrating NetFlow Analyzer with Log 360 - EventLog Analyzer

ManageEngine Log 360 - EventLog Analyzer is an Security Information and Event Management (SIEM) solution that helps you enhance your network security and comply with government-mandated and organization-level regulations, by collecting and analyzing your network logs. By integrating NetFlow Analyzer with Log 360 - EventLog Analyzer, users can forward their critical logs to Log 360 - EventLog Analyzer, and analyze them to gain deeper insights into user behavior, and identify anomalies and potential threats.

• Configuring Log 360 - EventLog Analyzer details in NetFlow Analyzer
• How does the NetFlow Analyzer - Log 360 EventLog Analyzer integration help network admins?
  
  1. Staying compliant with various regulations and frameworks
  2. Enhanced security
• What are the various reports that network admins can generate using this integration?
  
  1. Product Activity Reports
  2. Debug Reports
  3. Web Access Reports

Configuring Log 360 - EventLog Analyzer details in NetFlow Analyzer

To integrate NetFlow Analyzer with Log 360 - EventLog Analyzer, kindly follow the below steps:

• Go to Settings -> General Settings -> Third Party Integrations.
• Now, click on the "Configure" button found at the bottom-right corner of the Log 360 - EventLog Analyzer Section.
• Now, fill in the following details:
  • Server IP/DNS Name: Enter the IP address or the DNS name of the EventLog Analyzer-installed server, along with the port and the protocol.
  • Username: Enter the user name of the EventLog Analyzer user with the admin privilege.
  • Password: Enter the password of the EventLog Analyzer user with the admin privilege.
  • Select Log File: Select the logs to be forwarded to EventLog Analyzer, from the Select Log File drop down box.
    • Access logs: Logs that contain requests made to a web server, capturing information like the IP address, timestamp, requested resources, and outcomes of each request
    • Debug logs: Logs that are generated by NetFlow Analyzer during its operation, containing information used for diagnosing and troubleshooting issues.

How does the NetFlow Analyzer - Log 360 EventLog Analyzer integration help network admins?

By integrating NetFlow Analyzer with Log 360 - EventLog Analyzer, network admins can leverage the following functionalities.

Staying compliant with various regulations and frameworks

Centralized log management and analysis is a crucial mandate for most of the compliance regulations such as HIPAA, PCI-DSS, and so on. By centralizing and analyzing NetFlow Analyzer's debug and access logs, network admins can comply with the above said regulations.

Enhanced security

Since the debug and access logs are forwarded to Log 360 - EventLog Analyzer for analysis, network admins can know who accessed what in NetFlow Analyzer. Furthermore, network admins can also correlate access logs with debug logs, helping them troubleshoot network issues, fortify network security against potential unauthorized activities, and conducting extensive root cause analysis.

What are the various reports that network admins can generate using this integration

Once NetFlow Analyzer is integrated with Log 360 - EventLog analyzer, users' debug and access logs will automatically be forwarded to the EventLog Analyzer Server via Syslogs. The logs can then be visualized in the form of the following reports:

Product Activity Report

The product activity report category contains the All Activity report, which generates reports for all the logs forwarded from NetFlow Analyzer server.

Debug Reports

The following debug reports can be generated from the serverout & stdout(debug) logs of the NetFlow Analyzer.

• Instance Created: Obtain a detailed report that outlines the product's startup instance with the necessary configurations, within the chosen time period.
• Services Created: Generate a comprehensive report listing the services that were created during NetFlow Analyzer startup within the specified time frame. For example, services like StartupControllerService, PatchUpdaterService, CacheService, and others, were initiated during this process.
• Server Started: Obtain a comprehensive report detailing when the NetFlow Analyzer server was started within the selected time period.
• Successful Logins: Access a detailed report showcasing successful NetFlow Analyzer logins, including the respective login times, all within the chosen time frame.
• Failed Logins: Receive a comprehensive report detailing unsuccessful NetFlow Analyzer login attempts, complete with the corresponding login times that occurred within the selected time interval.

Web Access Reports

Web access reports generated from NetFlow Analyzer's access logs encompasses a range of HTTP status codes, such as Status Success, Internal Server Error, Gateway Timeout, etc., each reflecting distinct outcomes of client-server interactions.

This is how users can successfully integrate NetFlow Analyzer with Log 360 - EventLog Analyzer, and enhance their network security by analyzing their logs.