Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation

Like Niksun or Solera solution do ?

I'm talking about a SIEM and record solution of a entire network with intelligence investigation features, this tool of course can also be used sometimes for lawful interception in an ISP for example.

I found on the web some network solution from niksun or websense or for example on Solera.

I'm searching a solution to: - record traffic from 1 day to 36 month and have it on a accessible storage for analysys - features to make post analysis of the content from layer 4 to layer 7 (ip view but also content view of common protocol, chat communication, mail communication and any related traffic ). - alerting features triggered on rule based about traffic. example i can made an alert on detecting of a common word in a communication on a subset of the traffic (example only mail or chat traffic from a specific ip address) - Must have high bandwidth support, protocol identification at every layer, statistic reports and a common way to navigate the data.

What i'm asking for is not for a list of tool when an incident become but about solution to record all the traffic and to analyze all the traffic to identify data leak, misconfiguration and no-policy related utilization of the network.

anyone have experience on its solution and can share information and talk about it ?

share|improve this question
    
i havent enough reputation to add some tag to the question, i want tag this question with lawful-interception and also with deep-packet-inspection tags. –  boos Jan 16 '11 at 8:39
    
You should check out Solera Networks soleranetworks.com –  Tate Hansen Jan 16 '11 at 8:47
    
@Tate Hansen: do you have any experience with it ? can yoy say more on it ? why you havent answer at the question ? thanks –  boos Jan 16 '11 at 8:48
    
Well then I'm glad you dont have the rep yet :). In general, tags are not keywords. They are categories, and should serve to group similar questions together. –  AviD Jan 16 '11 at 8:53
    
@boos, I'm not clear what you mean by your edit. Could it be you mean something more like a logging solution, or SIEM? If you make this question different from the other one, feel free to flag it for mod's attention to reopen... –  AviD Jan 16 '11 at 9:36
show 6 more comments

2 Answers

Have you looked at NetWitness? Also, check out some of the posts and books from TaoSecurity on the topic of network security monitoring. There you'll find some methods that use open source technologies, but of course they'll require more work on your part.

share|improve this answer
add comment

Have a look at this question - it does mention a few tools that can do exactly what you want, from wireshark, which would need some scripting to wrap it up into what you are after to Argus and others.

share|improve this answer
1  
My question is not the same of the other one. I dont want a list of tool to use on an incident response, i want a solution to record all my data to identify after for example 6 month a data leak or to make assessment about protocol and traffic evidence for example 6 month ago in an enterprise solution. use wireshark to manage alert about 10Gb of traffic is not possible for example. –  boos Jan 16 '11 at 9:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.