Log capturing - event correlation, forensics, or audit / compliance widget?

As a security admin, you know that just about every device on your network spits out some kind of a log. And you also know (or you should know) that keeping track of those logs is an important piece of the puzzle to knowing your security posture. But you have to know the main purpose behind capturing logs before you can make a good decision on what method you will use to capture the logs.

So what is your reasoning behind capturing logs? Are you mainly trying to see what is going on with your network in order to spot potential security issues? If that is the case, then you need to investigate which technologies best do correlation and will help you see things on your network that you would have trouble seeing yourself. These systems are typically complicated and take a lot of planning effort in order to ensure good results. You need to have an intimate knowledge of your network to know avenues of attacks and vital systems so you can setup rules and alerts. They also require maintenance when changes are made on your network. However, if done right, these tools can give you a very good look into your network's security, and they can help find problems much quicker than a human could.

However, if your priority is not alerting and complicated correlation, then perhaps you simply want to capture the logs for forensic purposes and some simpler alerting. If this is the case, then you need to find those technologies that focus on disk space (high native capacity and possible expansion), the least amount of log normalization, and log protection (encryption and nonrepudiation). The reason behind limited log normalization (or none, if you can get it) and protecting logs is in case you have a security violation that will possibly involve a court case. You need to have the ability to prove that the logs are accurate and have not been changed in order to be accepted in court. These boxes also need to have the ability to move logs easily to storage and not have affect the nonrepuditation. The reason you need disk space is because if you are focusing on forensics, you will probably need to keep logs for a while.

Another reason that people have these types of devices is as an audit or compliance widget. Though I personally find this to be be the least important reason behind implementing log management, I also know that if it will get an auditor off my back, I will use it. And many manufacturers build in extensive audit and compliance reporting that are an auditors dream. If this is your need / desire, then make sure you focus on devices that have strong reporting characteristics.

Speaking of reporting, in my experience with these types of devices, I often find that a device is either very strong in one of the above characteristics, or it is very strong in reporting. Very few have strengths in both areas. However, it is my contention that manufacturers should focus heavily on both. Having all the information in the world does you no good if the user has no idea how to retieve it. And the security admins of the world love to have configurable dashboards that they can give to their boss (and the auditors I spoke of above) so they get fewer questions about what is going on in the network.

Most technologies available for log management will have all of the above features in some way, shape, or form, but they will vary in strength. When you are performing your risk analysis, determine what the focus of your company needs to be with log management. An example could be if you are a large enterprise with a very complicated network, then you may need to find a good correlation engine. Or, if you are a smaller firm that has high value intellectual property, you may want to have a box that focuses on forensic capabilities so you be sure to track down violations and recover your losses in a court of law.

Only you can decide on what will be the focus. Choose wisely.