Analyzing Data from Network Equipment | Protect Your Information with Intrusion Detection (Power)

Log files of routers and other network devices serve as an additional source of information on attacks that target the information resources of a corporate network. However, most organizations do not analyze these log files for traces of unauthorized activities, either because such logs do not exist or because the analysis tools (for example, netForensics) are rather expensive.

The task of collecting log-file information and analyzing logged security events can be delegated to the intrusion detection system, which in this case plays the role of a Syslog server. A Syslog server can centralize the process of collecting log-file information and detect attacks and misuses based on this information. Additionally, this measure protects log files from unauthorized modification, since all events logged by routers are immediately transmitted to the IDS sensor. This prevents the intruder from cleaning up the traces of his or her unauthorized activities.