CSI NetSec 2007 Six MIstakes of Log Management by Anton Chuvakin

Anton Chuvakin
Anton ChuvakinSecurity Strategy
Six Mistakes of Log Management  Dr Anton Chuvakin, GCIA, GCIH, GCFA Six Mistakes of Log Management
Summary ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Log Data Overview ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],What logs? From Where?
What Commonly “Gets Logged”? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
[object Object]
Regulations Mandate Logging and Log Review ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],and  NIST 800-92  “Guide to Security Log Management!”
NIST 800-92 “Guide to Computer Security Log Management” ,[object Object],[object Object],[object Object],[object Object]
[object Object]
Log Analysis Basics ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
[object Object]
Six  Mistakes of Log Management ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Conclusions ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Thanks for Attending!!! ,[object Object],[object Object],[object Object],[object Object],[object Object]
1 of 13

Recommended

Enterprise Logging and Log Management: Hot Topics by Dr. Anton Chuvakin by
Enterprise Logging and Log Management: Hot Topics by Dr. Anton ChuvakinEnterprise Logging and Log Management: Hot Topics by Dr. Anton Chuvakin
Enterprise Logging and Log Management: Hot Topics by Dr. Anton ChuvakinAnton Chuvakin
3.7K views24 slides
Logs: Can’t Hate Them, Won’t Love Them: Brief Log Management Class by Anton C... by
Logs: Can’t Hate Them, Won’t Love Them: Brief Log Management Class by Anton C...Logs: Can’t Hate Them, Won’t Love Them: Brief Log Management Class by Anton C...
Logs: Can’t Hate Them, Won’t Love Them: Brief Log Management Class by Anton C...Anton Chuvakin
5.1K views64 slides
"Grand Challenges" of Log Management by
"Grand Challenges" of Log Management"Grand Challenges" of Log Management
"Grand Challenges" of Log ManagementAnton Chuvakin
3.3K views17 slides
Best practises for log management by
Best practises for log managementBest practises for log management
Best practises for log managementBrian Honan
6.7K views18 slides
Choosing Your Log Management Approach: Buy, Build or Outsource by
Choosing Your Log Management Approach: Buy, Build or OutsourceChoosing Your Log Management Approach: Buy, Build or Outsource
Choosing Your Log Management Approach: Buy, Build or OutsourceAnton Chuvakin
3.8K views18 slides
Something Fun About Using SIEM by Dr. Anton Chuvakin by
Something Fun About Using SIEM by Dr. Anton ChuvakinSomething Fun About Using SIEM by Dr. Anton Chuvakin
Something Fun About Using SIEM by Dr. Anton ChuvakinAnton Chuvakin
7.5K views45 slides

More Related Content

Similar to CSI NetSec 2007 Six MIstakes of Log Management by Anton Chuvakin

Six Mistakes of Log Management 2008 by
Six Mistakes of Log Management 2008Six Mistakes of Log Management 2008
Six Mistakes of Log Management 2008Anton Chuvakin
2.1K views31 slides
Six Mistakes of Log Management Teaser Preso by
Six Mistakes of Log Management Teaser PresoSix Mistakes of Log Management Teaser Preso
Six Mistakes of Log Management Teaser PresoAnton Chuvakin
734 views6 slides
Log Management For e-Discovery, Database Monitoring and Other Unusual Uses by
Log Management For e-Discovery, Database Monitoring and Other Unusual UsesLog Management For e-Discovery, Database Monitoring and Other Unusual Uses
Log Management For e-Discovery, Database Monitoring and Other Unusual UsesAnton Chuvakin
1.3K views20 slides
How to Gain Visibility and Control: Compliance Mandates, Security Threats and... by
How to Gain Visibility and Control: Compliance Mandates, Security Threats and...How to Gain Visibility and Control: Compliance Mandates, Security Threats and...
How to Gain Visibility and Control: Compliance Mandates, Security Threats and...Anton Chuvakin
934 views22 slides
Application Logging Good Bad Ugly ... Beautiful? by
Application Logging Good Bad Ugly ... Beautiful?Application Logging Good Bad Ugly ... Beautiful?
Application Logging Good Bad Ugly ... Beautiful?Anton Chuvakin
6.2K views26 slides
Logs for Information Assurance and Forensics @ USMA by
Logs for Information Assurance and Forensics @ USMALogs for Information Assurance and Forensics @ USMA
Logs for Information Assurance and Forensics @ USMAAnton Chuvakin
1.1K views31 slides

Similar to CSI NetSec 2007 Six MIstakes of Log Management by Anton Chuvakin(20)

Six Mistakes of Log Management 2008 by Anton Chuvakin
Six Mistakes of Log Management 2008Six Mistakes of Log Management 2008
Six Mistakes of Log Management 2008
Anton Chuvakin2.1K views
Six Mistakes of Log Management Teaser Preso by Anton Chuvakin
Six Mistakes of Log Management Teaser PresoSix Mistakes of Log Management Teaser Preso
Six Mistakes of Log Management Teaser Preso
Anton Chuvakin734 views
Log Management For e-Discovery, Database Monitoring and Other Unusual Uses by Anton Chuvakin
Log Management For e-Discovery, Database Monitoring and Other Unusual UsesLog Management For e-Discovery, Database Monitoring and Other Unusual Uses
Log Management For e-Discovery, Database Monitoring and Other Unusual Uses
Anton Chuvakin1.3K views
How to Gain Visibility and Control: Compliance Mandates, Security Threats and... by Anton Chuvakin
How to Gain Visibility and Control: Compliance Mandates, Security Threats and...How to Gain Visibility and Control: Compliance Mandates, Security Threats and...
How to Gain Visibility and Control: Compliance Mandates, Security Threats and...
Anton Chuvakin934 views
Application Logging Good Bad Ugly ... Beautiful? by Anton Chuvakin
Application Logging Good Bad Ugly ... Beautiful?Application Logging Good Bad Ugly ... Beautiful?
Application Logging Good Bad Ugly ... Beautiful?
Anton Chuvakin6.2K views
Logs for Information Assurance and Forensics @ USMA by Anton Chuvakin
Logs for Information Assurance and Forensics @ USMALogs for Information Assurance and Forensics @ USMA
Logs for Information Assurance and Forensics @ USMA
Anton Chuvakin1.1K views
FIRST 2006 Full-day Tutorial on Logs for Incident Response by Anton Chuvakin
FIRST 2006 Full-day Tutorial on Logs for Incident ResponseFIRST 2006 Full-day Tutorial on Logs for Incident Response
FIRST 2006 Full-day Tutorial on Logs for Incident Response
Anton Chuvakin1.6K views
NIST 800-92 Log Management Guide in the Real World by Anton Chuvakin
NIST 800-92 Log Management Guide in the Real WorldNIST 800-92 Log Management Guide in the Real World
NIST 800-92 Log Management Guide in the Real World
Anton Chuvakin8.9K views
Log management and compliance: What's the real story? by Dr. Anton Chuvakin by Anton Chuvakin
Log management and compliance: What's the real story? by Dr. Anton ChuvakinLog management and compliance: What's the real story? by Dr. Anton Chuvakin
Log management and compliance: What's the real story? by Dr. Anton Chuvakin
Anton Chuvakin1.5K views
PCI DSS and Logging: What You Need To Know by Dr. Anton Chuvakin by Anton Chuvakin
PCI DSS and Logging: What You Need To Know by Dr. Anton ChuvakinPCI DSS and Logging: What You Need To Know by Dr. Anton Chuvakin
PCI DSS and Logging: What You Need To Know by Dr. Anton Chuvakin
Anton Chuvakin20.2K views
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008 by guestc0c304
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
guestc0c304269 views
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008 by Anton Chuvakin
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008
Anton Chuvakin2.9K views
What Every Organization Should Log And Monitor by Anton Chuvakin
What Every Organization Should Log And MonitorWhat Every Organization Should Log And Monitor
What Every Organization Should Log And Monitor
Anton Chuvakin2.3K views
Practical Strategies to Compliance and Security with SIEM by Dr. Anton Chuvakin by Anton Chuvakin
Practical Strategies to Compliance and Security with SIEM by Dr. Anton ChuvakinPractical Strategies to Compliance and Security with SIEM by Dr. Anton Chuvakin
Practical Strategies to Compliance and Security with SIEM by Dr. Anton Chuvakin
Anton Chuvakin3.4K views
Security Practices - Logging.pptx by Alireza Vafi
Security Practices - Logging.pptxSecurity Practices - Logging.pptx
Security Practices - Logging.pptx
Alireza Vafi12 views
Making Logs Sexy Again: Can We Finally Lose The Regexes? by Anton Chuvakin
Making Logs Sexy Again: Can We Finally Lose The Regexes?Making Logs Sexy Again: Can We Finally Lose The Regexes?
Making Logs Sexy Again: Can We Finally Lose The Regexes?
Anton Chuvakin2.4K views
Log Forensics from CEIC 2007 by Anton Chuvakin
Log Forensics from CEIC 2007Log Forensics from CEIC 2007
Log Forensics from CEIC 2007
Anton Chuvakin1.2K views

More from Anton Chuvakin

SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En... by
SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...
SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...Anton Chuvakin
33 views22 slides
SOC Lessons from DevOps and SRE by Anton Chuvakin by
SOC Lessons from DevOps and SRE by Anton ChuvakinSOC Lessons from DevOps and SRE by Anton Chuvakin
SOC Lessons from DevOps and SRE by Anton ChuvakinAnton Chuvakin
265 views18 slides
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 Booth by
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 BoothHey SOC, Look LEFT! by Anton Chuvakin RSA 2023 Booth
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 BoothAnton Chuvakin
139 views10 slides
20 Years of SIEM - SANS Webinar 2022 by
20 Years of SIEM - SANS Webinar 202220 Years of SIEM - SANS Webinar 2022
20 Years of SIEM - SANS Webinar 2022Anton Chuvakin
283 views21 slides
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin by
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton ChuvakinAnton Chuvakin
391 views25 slides
SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends by
SOCstock 2020  Groovy SOC Tunes aka Modern SOC TrendsSOCstock 2020  Groovy SOC Tunes aka Modern SOC Trends
SOCstock 2020 Groovy SOC Tunes aka Modern SOC TrendsAnton Chuvakin
286 views14 slides

More from Anton Chuvakin(20)

SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En... by Anton Chuvakin
SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...
SANS Webinar: The Future of Log Centralization for SIEMs and DFIR – Is the En...
Anton Chuvakin33 views
SOC Lessons from DevOps and SRE by Anton Chuvakin by Anton Chuvakin
SOC Lessons from DevOps and SRE by Anton ChuvakinSOC Lessons from DevOps and SRE by Anton Chuvakin
SOC Lessons from DevOps and SRE by Anton Chuvakin
Anton Chuvakin265 views
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 Booth by Anton Chuvakin
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 BoothHey SOC, Look LEFT! by Anton Chuvakin RSA 2023 Booth
Hey SOC, Look LEFT! by Anton Chuvakin RSA 2023 Booth
Anton Chuvakin139 views
20 Years of SIEM - SANS Webinar 2022 by Anton Chuvakin
20 Years of SIEM - SANS Webinar 202220 Years of SIEM - SANS Webinar 2022
20 Years of SIEM - SANS Webinar 2022
Anton Chuvakin283 views
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin by Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
10X SOC - SANS Blue Summit Keynote 2021 - Anton Chuvakin
Anton Chuvakin391 views
SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends by Anton Chuvakin
SOCstock 2020  Groovy SOC Tunes aka Modern SOC TrendsSOCstock 2020  Groovy SOC Tunes aka Modern SOC Trends
SOCstock 2020 Groovy SOC Tunes aka Modern SOC Trends
Anton Chuvakin286 views
SOCstock 2021 The Cloud-native SOC by Anton Chuvakin
SOCstock 2021 The Cloud-native SOC SOCstock 2021 The Cloud-native SOC
SOCstock 2021 The Cloud-native SOC
Anton Chuvakin429 views
Anton's 2020 SIEM Best and Worst Practices - in Brief by Anton Chuvakin
Anton's 2020 SIEM Best and Worst Practices - in BriefAnton's 2020 SIEM Best and Worst Practices - in Brief
Anton's 2020 SIEM Best and Worst Practices - in Brief
Anton Chuvakin340 views
RSA 2016 Security Analytics Presentation by Anton Chuvakin
RSA 2016 Security Analytics PresentationRSA 2016 Security Analytics Presentation
RSA 2016 Security Analytics Presentation
Anton Chuvakin497 views
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin by Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton ChuvakinFive Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Anton Chuvakin10K views
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin by Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton ChuvakinFive Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Five Best and Five Worst Practices for SIEM by Dr. Anton Chuvakin
Anton Chuvakin14K views
On Content-Aware SIEM by Dr. Anton Chuvakin by Anton Chuvakin
On Content-Aware SIEM by Dr. Anton ChuvakinOn Content-Aware SIEM by Dr. Anton Chuvakin
On Content-Aware SIEM by Dr. Anton Chuvakin
Anton Chuvakin1.7K views
Making Log Data Useful: SIEM and Log Management Together by Dr. Anton Chuvakin by Anton Chuvakin
Making Log Data Useful: SIEM and Log Management Together by Dr. Anton ChuvakinMaking Log Data Useful: SIEM and Log Management Together by Dr. Anton Chuvakin
Making Log Data Useful: SIEM and Log Management Together by Dr. Anton Chuvakin
Anton Chuvakin2.6K views
PCI 2.0 What's Next for PCI DSS by Dr. Anton Chuvakin by Anton Chuvakin
PCI 2.0 What's Next for PCI DSS  by Dr. Anton ChuvakinPCI 2.0 What's Next for PCI DSS  by Dr. Anton Chuvakin
PCI 2.0 What's Next for PCI DSS by Dr. Anton Chuvakin
Anton Chuvakin1.2K views
Navigating the Data Stream without Boiling the Ocean:: Case Studies in Effec... by Anton Chuvakin
Navigating the Data Stream without Boiling the Ocean::  Case Studies in Effec...Navigating the Data Stream without Boiling the Ocean::  Case Studies in Effec...
Navigating the Data Stream without Boiling the Ocean:: Case Studies in Effec...
Anton Chuvakin995 views

Recently uploaded

Forex secret by
Forex secret Forex secret
Forex secret konghatatih
15 views6 slides
Group and Teams: Increasing Cooperation and Reducing Conflict by
Group and Teams: Increasing Cooperation and Reducing Conflict Group and Teams: Increasing Cooperation and Reducing Conflict
Group and Teams: Increasing Cooperation and Reducing Conflict Seta Wicaksana
13 views14 slides
shoot pitch.pptx by
shoot pitch.pptxshoot pitch.pptx
shoot pitch.pptxlomatteo995
7 views17 slides
case study of Insertion Type Magnetic Flowmeter exports to Australia_ (1).docx by
case study of Insertion Type Magnetic Flowmeter exports to Australia_ (1).docxcase study of Insertion Type Magnetic Flowmeter exports to Australia_ (1).docx
case study of Insertion Type Magnetic Flowmeter exports to Australia_ (1).docxDalian Zero Instrument Technology Co., Ltd China
24 views5 slides
Skilled Landscape Contractor by
Skilled Landscape ContractorSkilled Landscape Contractor
Skilled Landscape ContractorEmmanuelRyker
21 views8 slides
duck railing.pdf by
duck railing.pdfduck railing.pdf
duck railing.pdfaluminumdeckrailingc
6 views1 slide

Recently uploaded(20)

Group and Teams: Increasing Cooperation and Reducing Conflict by Seta Wicaksana
Group and Teams: Increasing Cooperation and Reducing Conflict Group and Teams: Increasing Cooperation and Reducing Conflict
Group and Teams: Increasing Cooperation and Reducing Conflict
Seta Wicaksana13 views
Skilled Landscape Contractor by EmmanuelRyker
Skilled Landscape ContractorSkilled Landscape Contractor
Skilled Landscape Contractor
EmmanuelRyker21 views
chung chi tam compact chiu axit by MaiThiAnh
chung chi tam compact chiu axitchung chi tam compact chiu axit
chung chi tam compact chiu axit
MaiThiAnh14 views
voice logger software aegis.pdf by Nirmal Sharma
voice logger software aegis.pdfvoice logger software aegis.pdf
voice logger software aegis.pdf
Nirmal Sharma10 views
Top 10 Web Development Companies in California by TopCSSGallery
Top 10 Web Development Companies in CaliforniaTop 10 Web Development Companies in California
Top 10 Web Development Companies in California
TopCSSGallery26 views
AIR FRESHENER SUPPLIERS IN MUSCAT OMAN by Hygienelinks2
AIR FRESHENER SUPPLIERS IN MUSCAT OMANAIR FRESHENER SUPPLIERS IN MUSCAT OMAN
AIR FRESHENER SUPPLIERS IN MUSCAT OMAN
Hygienelinks26 views
Presentation on proposed acquisition of leading European asset manager Aermon... by KeppelCorporation
Presentation on proposed acquisition of leading European asset manager Aermon...Presentation on proposed acquisition of leading European asset manager Aermon...
Presentation on proposed acquisition of leading European asset manager Aermon...
NewBase 23 November 2023 Energy News issue - 1676 by Khaled Al Awadi_compre... by Khaled Al Awadi
NewBase  23 November 2023  Energy News issue - 1676 by Khaled Al Awadi_compre...NewBase  23 November 2023  Energy News issue - 1676 by Khaled Al Awadi_compre...
NewBase 23 November 2023 Energy News issue - 1676 by Khaled Al Awadi_compre...
Khaled Al Awadi17 views
RESIDENTIAL CARPENTRY SERVICES – COLOR RENOVATION INC by colorrenovation
RESIDENTIAL CARPENTRY SERVICES – COLOR RENOVATION INCRESIDENTIAL CARPENTRY SERVICES – COLOR RENOVATION INC
RESIDENTIAL CARPENTRY SERVICES – COLOR RENOVATION INC
colorrenovation18 views
2023 Photo Contest.pptx by culhama
2023 Photo Contest.pptx2023 Photo Contest.pptx
2023 Photo Contest.pptx
culhama21 views
PMU Launch - Guaranteed Slides by pmulaunch
PMU Launch - Guaranteed SlidesPMU Launch - Guaranteed Slides
PMU Launch - Guaranteed Slides
pmulaunch11 views

CSI NetSec 2007 Six MIstakes of Log Management by Anton Chuvakin

  • 1. Six Mistakes of Log Management Dr Anton Chuvakin, GCIA, GCIH, GCFA Six Mistakes of Log Management
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.