difference between firewall log management and Splunk Security Log management as a SIEM

[V4M51]

difference between firewall log management and Splunk Security Log management as a SIEM

[FrankVl · Accepted solution]

Using a central SIEM tool like Splunk, rather that doing log management and analysis on each security product's own GUI means you can much more easily correlate events happening across your infrastructure and have 1 centralized event analysis workflow.

If you're just dealing with firewall logs, that may not be a huge added value (although I bet Splunk has a lot more advanced log analysis features than your firewall management console), but as soon as you also want to look at your proxy logs, anti virus, IDS/IPS, windows events, unix syslog, etc. etc. it really becomes unmanageable to do that using each platform's own dedicated log management tooling.

[V4M51]

The statement (although I bet Splunk has a lot more advanced log analysis features than your firewall management console) you mentioned i do accept it, Can you help me with what are the advanced log analysis features that you mentioned.

[V4M51]

for my understanding and get start using Splunk for advanced log analysis features which would make my task a bit easier.

[FrankVl]

That's hard to say, as I don't know features of your firewall log management solution of course. I'd suggest to just start with the Splunk trainings to familiarize yourself with the capabilities Splunk has to offer.

Splunk Fundamentals 1 is free and gives a good introduction 🙂

[FrankVl]

Can you perhaps clarify your question? I don't really understand what information you are looking for.

[V4M51]

We have log management and log analysis that can be done on Firewall GUI as well, Then what is the use of using Splunk instead we can do log management and analysis from Firewall also.