All right, Syslog tools.
Okay, Syslog runs over UDP Port 514 by default.
It's a centralized logging protocol.
Windows has no native Syslogging functionality.
So in order to log to a Windows Syslog server, you need to install it.
Kiwi Syslog Server, Nt Syslog, couple of examples, and then the agents need to be
installed to forward the events to the centralized server.
The most notable Syslog tool, which is an
SIEM, which is Syslog Plus, would be Splunk, you have ArcSight, ArianEvolve,
Carbon and Black, Q radar, and a bunch of others.
But Splunk is probably going to be the dominant SIEM on the planet these days.
And you've got lots of lab exercises around Splunk.
Speaking of splunk, Log Management Tools,
Splunk aggregates log data, provides insights to quickly detect and respond to
internal external attacks and simplify threat management.
Again, splunk is pretty much the top of the heap.
I got a couple of labs, like I said, on
splunk, which will introduce you and get your feet wet with splunk.
That is going to wrap up Module 18, Network Logs Monitoring and Analysis.
Got some cool apps for you on that one as well.