Gather Your Security Events
The first thing to do when you want to improve your network security is to collect all the information that interests you in one single place. Why? Just imagine that your IDS has detected an attack against one of your servers: The security manager will have to investigate many different logs generated by various security equipment: routers, firewalls etc to see if there is any clue about this attack.
The problem with logs is they are everywhere, each of your security devices creates its own log; creating many GB of data in a short time. Have you ever tried to find what interests you in 20GB of data? Have you ever tried to find a common event between two logs of many GB each? Most administrators have done this at one time and few found what they wanted within a short lapse of time. It takes too much time for the administrators to find what they are looking for to have an efficient reactivity.
Here, we can understand that administrators should have all relevant logs in one single logging facility.
SECcollect enables you to receive the information in several ways:
- Syslog
- Log File
- Windows Event Log
Collect events in real-time
The SECnology bundle includes a Syslog server that provides you with a possibility to see in real time the events taking place in your environment. You may decide to collect original, raw log data with this tool, or predefine a filter for your convenience thus increasing the quality of the incoming information.
In case a certain equipement doesn't possess any mechanism to send its log data to Syslog - it is always possible to install a SECnology Agent to collect in real time the traces your application leave in a file or a directory.
Don't lose logs
With it's Collector, SECnology can guarantee zero possibility of losing event traces even in case of Flooding with thousands of lines per second.
SNMP server to be expected soon
Our team of high-skilled and experienced specialists is constantly working on the improvement of the product by adding new features. We are looking forward to provide you with an embedded SNMP server that will be capable of collecting and managing all the info contained in SNMP traps to add and correlate them with the data received by Syslog.
