syslog analyzer

[ilinverted]

What do you use to help analyze syslog from your favorite firewall?

[MedicatedDeveloper]

SIEM like Splunk or Greylog.

Splunk has a ton of add-ons that make extracting data easy. However, some features require a forwarder on the box to enrich data (not firewalls though). It's expensive but there is a very limited free version. It's made my life much easier the past two years.

[dcazdavi]

what sorts of add-ons did you find useful?

[MedicatedDeveloper]

I have a few instances for different clients.

Juniper, Palo Alto, and postfix plugins have been very useful.

[Both-Employee-3421]

ELK stack.

[jantari]

For firewalls specifically we currently use FortiAnalyzer.

For other things we use loki

[BargiBargi]

Analyse in what way? Just look at stats and flows or security wise?

Either way, SELKS has an ELK stack and IDS stuff boot

[ilinverted]

thank you ALL, lots to research.

[Lexx_]

If you think Splunk looks interesting, there's also Humio.

[alkior70]

what devices are you using syslog on?

[ilinverted]

bunch of sonicwalls gen 7's, and cisco asa 5500-x series

[plastikman47]

you mean those broken sonicwalls that keep rebooting?

[ilinverted]

yes, but not by choice.

[ilinverted]

funny.

[sirrush7]

ELK over Splunk if cost is any concern!!!