Background & Standards

• Logging and Audit Overview
• Specifications and Standards
• Archiving Secure Audit Files
• Programming syslog

Logging Infrastructure

• Centralized Logging
• syslog Replacements (UNIX)
• syslog Servers (non-UNIX)
• UNIX & related (routers, FWs) to syslog
• Windows to syslog
• Logfile Rotation Tools

Data Analysis

• Log Parsers (App Specific)
• Log Parsers (Generic)
• Regular Expressions
• Data Correlation
• Sample Log Files
• Intrusion Signatures
• Message Dictionaries
• Messages that Made Us Laugh

Resources

• Mailing Lists
• Research

Data Correlation

• Correlation of Vulnerability Audit and IDS Alerts: Classifying and grouping alerts received from multiple security monitoring systems
• Simple Event Correlator: an event correlation tool that can also be used for logfile monitoring tasks (also available at http://kodu.neti.ee/~risto/sec/). It incorporates a number of features from swatch and logsurfer. Contact Risto Vaarandi for more information