PIX Log Monitoring

[OUCATS]

I am looking for a good way to monitor the logs for activity like port scanning or actual hacking. I have been using kiwi to capture the logs for months, but it's not very useful when actually reviewing the pix logs. Does anyone have any recommendations? I have been reviewing Firegen and Stonylakes Reporter but neither is very helpful. I am considering getting an eval of CiscoWorks (pricing around $5000) just to see if that works, but I would like something priced more like $500(plus or minus).

Thanks!

 

[flauret]

hello

I think you should check netiq firewal suite. may be it's not so expensive for your configuration and golld give you the result that you look for.

frederic

 

[wybnormal]

Hows a 100 bucks grab you? Take a look at Sawmill which can read the raw Cisco PIX log files and gen nice HTML reports (and others)

SWATCH is another and LogSurfer.

MikeS

http://www.packetattack.com

http://www.packetpress.net

Home of the book "Network Security Using Linux"