Logging and Reviewing Firewall Logs

josepherdt · ‎08-20-2007

Is there a heuristic for setting up an intrusion detection system with a Cisco ISR? We would like to utilize our firewall logs for an intrusion detection system.

thomas.chen · ‎08-24-2007

Following links may help you

http://www.cisco.com/en/US/products/ps6498/prod_release_note09186a00806186f0.html

http://www.cisco.com/en/US/products/ps6634/products_white_paper0900aecd8062acfb.shtml

mhellman · ‎08-24-2007

There are tools that will correlate firewall logs, if that's what you mean. To get you going, there's Cisco's own SIM product, MARS.

http://www.cisco.com/go/mars

There's the open source OSSIM: http://www.ossim.net/.

attmidsteam · ‎08-24-2007

Intellitactics NSM will cross correlate many device types including routers, firewalls, & sensors:

http://www.intellitactics.com/int/