App for firewall traffic analysis

[tsix]

We like to consolidate logs of different firewall vendors with Splunk. Is there an app that allows searching for several fields (source, dest, port, proto, etc.), presents the results and implements drill down searches on theses results?

Thanks for your help.

[tiagofbmm]

Hello

Yes it does exist, it is called Splunk Enterprise Security!

https://splunkbase.splunk.com/app/263/

[tsix]

Thanks for recommending ES. But we like to have something more targeted towards firewall operation. We are about to write a couple of dashboards that allow searching firewall traffic logs for blocked connections and analyze rule usage and such. I assume we are not the first having such a use case.

[tiagofbmm]

If you are about to write the dashboard yourself, I would suggest you to take a look at the one of the DataModels in ES ann do it for your own use case.