Discover What Security Threats are Lurking in Your Network Logs! Proactive threat management is a must in today’s networks, and log files hold the key. Learn how to make your log files work for you to secure your network in an increasingly threat-ridden landscape.

1. 1
Best Practices for Log & Event
Management
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
Discover Security Threats
Lurking in Your Network Logs

2. 2
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
2
You Can’t Control What You Can’t See!

3. 3
Agenda
» The Problem
» Best Practices for Log & Event Management
» How SolarWinds® Can Help
» Additional Resources
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
3

4. 4
The Problem
Network threats are happening at a fast and furious pace! Plus,
they’re becoming sneakier and craftier. And, it’s not just external
threats you have to worry about – insider abuse is on the rise!
4
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED

5. 5
The Key to the Solution
The good news is that your IT infrastructure’s log files hold the
key for mitigating threats and thwarting attacks, but only if
they’re handled properly.
5
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
® ®
®
Make your log files work for
you! Otherwise, they’re just
taking up space.

6. 6
Best Practices for Log & Event Management
6
 Define your log management policies and procedures
 Log all relevant and required data (but don’t “over-log”)
 Centrally aggregate all logged data
 Store logs securely and retain for the required amount of time
 Normalize log data and categorize events
 Correlate events across multiple log sources
 Prioritize events based on criticality
 Provide multiple notification methods
 Run regularly scheduled security and compliance reports
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED

7. 7
Log Management vs. SIEM
» Log Management is the comprehensive collection of all logs and the
retention of both raw and parsed log data for operational purposes, including
network and application troubleshooting, as well as broad use historical
reporting.
» SIEM (Security Information and Event Management) builds upon log
management by providing the critical piece of event correlation for the
primary purpose of detecting, mitigating and remediating network security
threats. Also, very importantly, SIEM provides real-time or near real-time
visibility into events to minimize the crucial time between detection and
response.
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
7

8. 8
How SolarWinds LEM Can Help
 Automated log collection from anywhere data is generated within the IT
infrastructure—network devices, security devices, applications, databases,
virtual machines, cloud, and more
 Real-time, in-memory event correlation to instantly view a security breach, and
nearly 700 built-in correlation rules for visibility right out of the box
 Built-in active responses to instantly and automatically take action to
remediate a threat, such as blocking an IP, killing a process, or logging off a user
 Advanced, easy-to-use, search interface with drag-and-drop simplicity, data
visualization, and drill-down details for fast and effective forensic analysis
 Over 300 out-of-the-box, “audit-proven” security and compliance templates
including PCI, HIPAA, SOX, GLBA and many more
 USB-Defender® technology protects sensitive data with real-time monitoring,
device detection, notification, and the ability to block usage
8
LEM
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED

9. 9
SolarWinds Log & Event Manager (LEM)
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
9
SolarWinds Log & Event Manager Collects and Correlates Log Data in Real-Time,
while also providing Automated Active Responses for Instant Threat Mitigation

10. 10
Additional Resources
 SolarWinds Log & Event Manager Overview
 SolarWinds Log & Event Manager Guided Tour
 Why & How of Monitoring Workstations with Log & Event Manager
 Combat Security Threats with SolarWinds LEM's Active Responses
 Case Study: SolarWinds LEM & EasyStreet
 Case Study: SolarWinds LEM & United States Postal Service Federal
Credit Union
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
10

11. 11
Trademark
The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of
SolarWinds Worldwide, LLC, are registered with the U.S. Patent and Trademark Office,
and may be registered or pending registration in other countries. All other SolarWinds
trademarks, service marks, and logos may be common law marks, registered or
pending registration in the United States or in other countries. All other trademarks
mentioned herein are used for identification purposes only and may be or are
trademarks or registered trademarks of their respective companies.
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED
11

12. 12
Thank You!
© 2013 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED