topic Re: difference between firewall log management and Splunk Security Log management as a SIEM in Splunk Enterprise Security

difference between firewall log management and Splunk Security Log management as a SIEM

V4M51 — Wed, 25 Apr 2018 04:35:17 GMT

difference between firewall log management and Splunk Security Log management as a SIEM

Re: difference between firewall log management and Splunk Security Log management as a SIEM

FrankVl — Wed, 25 Apr 2018 09:20:25 GMT

Can you perhaps clarify your question? I don't really understand what information you are looking for.

Re: difference between firewall log management and Splunk Security Log management as a SIEM

V4M51 — Wed, 25 Apr 2018 09:49:19 GMT

We have log management and log analysis that can be done on Firewall GUI as well, Then what is the use of using Splunk instead we can do log management and analysis from Firewall also.

Re: difference between firewall log management and Splunk Security Log management as a SIEM

FrankVl — Wed, 25 Apr 2018 09:59:11 GMT

Using a central SIEM tool like Splunk, rather that doing log management and analysis on each security product's own GUI means you can much more easily correlate events happening across your infrastructure and have 1 centralized event analysis workflow.

If you're just dealing with firewall logs, that may not be a huge added value (although I bet Splunk has a lot more advanced log analysis features than your firewall management console), but as soon as you also want to look at your proxy logs, anti virus, IDS/IPS, windows events, unix syslog, etc. etc. it really becomes unmanageable to do that using each platform's own dedicated log management tooling.

Re: difference between firewall log management and Splunk Security Log management as a SIEM

V4M51 — Wed, 25 Apr 2018 11:11:12 GMT

The statement (although I bet Splunk has a lot more advanced log analysis features than your firewall management console) you mentioned i do accept it, Can you help me with what are the advanced log analysis features that you mentioned.

Re: difference between firewall log management and Splunk Security Log management as a SIEM

V4M51 — Wed, 25 Apr 2018 11:12:59 GMT

for my understanding and get start using Splunk for advanced log analysis features which would make my task a bit easier.

Re: difference between firewall log management and Splunk Security Log management as a SIEM

FrankVl — Wed, 25 Apr 2018 11:19:12 GMT

That's hard to say, as I don't know features of your firewall log management solution of course. I'd suggest to just start with the Splunk trainings to familiarize yourself with the capabilities Splunk has to offer.

Splunk Fundamentals 1 is free and gives a good introduction 🙂