Log aggregation

The need for log aggregation

Logs record important security events occurring in a network and play a pivotal role in detecting, investigating, and mitigating security incidents. Virtually all critical systems and applications in a network have built-in logging mechanisms that help administrators track security events of interest. However, logs from individual sources cannot provide the complete picture of what's going on in a network. A user in a network may trigger events across various systems, and viewing the Windows Event Log, or logs from other sources such as firewalls and databases in silos, won't suffice. Instead, admins need to aggregate log data from the various sources in the network and centrally manage, store, and analyze the data.

Typical log sources in a network

While networks vary across organizations, most have the following log sources:

• Servers (Windows/Unix)
• Workstations
• Files and folders
• Databases
• Web servers
• Firewalls
• Routers
• Switches
• IDS/IPS
• Security solutions such as vulnerability scanners

Logs from these different sources need to be aggregated using a log management tool.

Collecting logs from different sources

Logs can be ingested into a log management tool via an agent, or by using agentless mechanisms depending on log source and other restrictions. Collecting logs boils down to two steps:

• Define a logging policy on the administrator interface of the concerned device. Ensure an optimal logging policy is set to track security events of interest.
• Send the logs to the log management tool. This can typically be configured from the tool's GUI.

Centralize log management with EventLog Analyzer

ManageEngine's EventLog Analyzer is a comprehensive log management tool that can aggregate logs from various sources in a network, including the ones mentioned above, to provide a centralized view of important security events occurring in the network.

• Unified, intuitive dashboard: The customizable dashboard provides a summary of all the security events occurring in the network. This gives security teams a complete snapshot of the key activities at a glance. The dashboard views available are:

  Events overview: Security teams can see the total number of events collected, log trends, alerts triggered, split-up of events based on severity, and other important details.

  Network overview: Security teams can view the allowed and denied connections by firewalls, analyze the traffic trends, and track VPN logons.

  Security overview: Security teams can view the threats that have been flagged from threat sources, IDS/IPS, and correlation rules.

• Robust search engine: EventLog Analyzer's powerful click-based search engine allows security teams to efficiently investigate security incidents. The interface is easy to use and provides advanced querying functions. Important information pertaining to a given security incident can be extracted in just a few clicks; the search result can then be saved as a report or as an alert profile as needed.

Need Features? Tell Us
If you want to see additional features implemented in EventLog Analyzer, we would love to hear. Click here to continue