Log Management

Email this Page Share This Page

Logs are recorded traces or evidence of activity that occurs on the various hardware, software, and other security-related products deployed on a critical control system. A sound security strategy must include identification of all such cyber assets and enabling or configuring them to log events. These logs could prove essential in the cyber forensics of a compromised device or provide insight into an unknown risk that requires mitigation.

An event log can be likened to a single strand of hair. Without an SIEM device, picking out suspicious activity would be similar to sorting through an entire head of hair looking for an abnormal strand.

Log management involves the accumulation, review or analysis, and response related to the significant events that occur on all critical devices. Because of the volume of logs a single network or even device can generate, perform these tasks on a periodic basis, such as weekly or bi-weekly, is quite daunting without utilizing a tool, such as a Security Information and Event Management (SIEM) device. The primary functions of an SIEM are:

1. Aggregate logs from all critical devices
2. Analyze the logs against a rule set to identify significant events
3. Create alerts for any suspicious log activity
4. Organize and provide access to historical log data for audits, forensics, and root cause analysis following an event

FoxGuard can help identify the best Log Management solution to meet your needs taking into account the size of your network, number of devices, and compliance requirements governing your industry. Our staff can work with your team to identify and customize security reports to allow log management to greatly support your security posture while supporting audits and greatly reducing resources around the periodic review of logs.

Related Products & Services

• SIEM