Intrusion Detection Systems: RE: Tivoli Cross-Site for Security (was: RE: Ramping up for anoth er r eview)

[Kevin.Sanchez-Cherry () nasd com (Sanchez-Cherry, Kevin)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
 I would also be interested in this.  My company is considering using Tivoli
security to work with Axent's ITA and NetIQ.

-----Original Message-----
From: Lustiger, Alan [mailto:ALustiger () datek com]
Sent: Thursday, July 13, 2000 11:17 AM
To: 'Greg Shipley'; ids () uow edu au
Subject: IDS: Tivoli Cross-Site for Security (was: RE: Ramping up for
another r eview)

I'm trying to put together a framework for an IDS system, and I'm looking 
at Tivoli as a back-end database to consolidate and correlate alarms from 
various NIDS. Now it looks like Tivoli might have its own complete solution 
( http://www.tivoli.com/products/documents/datasheets/cross-site_sec.html
<http://www.tivoli.com/products/documents/datasheets/cross-site_sec.html> )
. 

Has anyone looked at using this either as their entire solution or as an 
integrator for existing NIDS, HIDS and firewall log files? 

Thanks! 

-- 
Alan Lustiger 
alustiger () datek com