Re: Importing Security Product Output Into A Database

[Tremaine Lea <security-basics () ddiction com>]

Arcsight comes to mind.

The number of products it supports is pretty impressive.

A very incomplete list would include nmap, nessus, cisco, tipping  
point IPS, AD servers, syslog and checkpoint.


---

Tremaine Lea
Network Security Consultant

Be in pursuit of equality, but not at the expense of excellence.


On 31-May-07, at 3:20 AM, Florencio Cano wrote:

> Hello,
> Can you give examples about good SIM tools that do the work?
> Thanks
>
> 2007/5/30, Ken Swain <ken () kenswain com>:
> > Any SIM tool can do this. You can write queries to find anything you
> > are looking for. Some of the information can leveraged automatically
> > to alert and draw your attention to spacific incidents.
> >
> > On May 29, 2007, at 3:21 PM, Daniel Miessler wrote:
> >
> > > I'm wondering if anyone here knows of a product -- commercial or
> > > otherwise -- that is able to parse output from various tools, such
> > > as Foundscan, Nessus, Nmap, WebInspect, etc. and pull them into a
> > > single database format.
>
> --
> Florencio Cano Gabarda