Splunk Enterprise Security

difference between firewall log management and Splunk Security Log management as a SIEM

V4M51
Engager

difference between firewall log management and Splunk Security Log management as a SIEM

0 Karma
1 Solution

FrankVl
Ultra Champion

Using a central SIEM tool like Splunk, rather that doing log management and analysis on each security product's own GUI means you can much more easily correlate events happening across your infrastructure and have 1 centralized event analysis workflow.

If you're just dealing with firewall logs, that may not be a huge added value (although I bet Splunk has a lot more advanced log analysis features than your firewall management console), but as soon as you also want to look at your proxy logs, anti virus, IDS/IPS, windows events, unix syslog, etc. etc. it really becomes unmanageable to do that using each platform's own dedicated log management tooling.

View solution in original post

0 Karma

FrankVl
Ultra Champion

Using a central SIEM tool like Splunk, rather that doing log management and analysis on each security product's own GUI means you can much more easily correlate events happening across your infrastructure and have 1 centralized event analysis workflow.

If you're just dealing with firewall logs, that may not be a huge added value (although I bet Splunk has a lot more advanced log analysis features than your firewall management console), but as soon as you also want to look at your proxy logs, anti virus, IDS/IPS, windows events, unix syslog, etc. etc. it really becomes unmanageable to do that using each platform's own dedicated log management tooling.

View solution in original post

0 Karma

V4M51
Engager

The statement (although I bet Splunk has a lot more advanced log analysis features than your firewall management console) you mentioned i do accept it, Can you help me with what are the advanced log analysis features that you mentioned.

0 Karma

V4M51
Engager

for my understanding and get start using Splunk for advanced log analysis features which would make my task a bit easier.

0 Karma

FrankVl
Ultra Champion

That's hard to say, as I don't know features of your firewall log management solution of course. I'd suggest to just start with the Splunk trainings to familiarize yourself with the capabilities Splunk has to offer.

Splunk Fundamentals 1 is free and gives a good introduction 🙂

0 Karma

FrankVl
Ultra Champion

Can you perhaps clarify your question? I don't really understand what information you are looking for.

0 Karma

V4M51
Engager

We have log management and log analysis that can be done on Firewall GUI as well, Then what is the use of using Splunk instead we can do log management and analysis from Firewall also.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!