All, I have discovered over the past few months that the TPM crashes consistently, that when it does work it doesn't do much with Cisco PIX logs, and that Fusion does nothing with the paltry data that the TPM will process. Now we see ISS confirm this. Why haven't we seen support for the TPM? My guess is that the TPM was a pet project that fell out of favor when someone pointed out it that either SiteProtector was going to have to go full tilt towards SIM-ness or stick to their core competence. (Disclaimer: this is pure speculation on my part. Flaming emails will be sent to /dev/null)
I have also reached the same point as Sergey raised last month in regards to database management (see "DB backups and offline access"). When using SNORT I could easily maintain an "online" database of one month's worth of data, and an "offline" database of 6 months of archival data. As RealSecureDB grows, not only will we encounter a performance hit, but the backup dilemma looms large (disk space, increasing backup time, expanding backup windows impacting other backup jobs.....) Combine these two issues, and Stephen Cooper's advice looks good: buy a SIM. So here's the question: anyone using a SIM with ISS? If so, which one? Jason Baeder CISSP, GCIA --- Sergey V Soldatov <[EMAIL PROTECTED]> wrote: > > If you'll take FusionFAQ_v2.0.pdf, you'll find: > 8. Will the Security Fusion Module correlate third party data? > The Security Fusion Module currently will only correlate events > that are > being inserted into the SiteProtector Database. For the Security > Fusion > Module to be able to automate the correlation of events from a > sensor the > SiteProtector database must be able to accept the data. As > SiteProtector > adds the ability to collect third party data, the Security Fusion > Module > will begin to determine how to automate the correlation of that data. > > Does it mean that in case of Third Party Module (TPM) usage Fusion > Module > will correlate events for Cisco PIX and Checkpoint FW1 as this FWs > are > supported by TPM? As I have undestood using TPM, Fusion Module does > not > correlate Cisco PIX's events came via TPM into SiteProtector DB. So, > Fusion > correlates not all events "that are being inserted into the > SiteProtector > Database", but only events from RNEs, RSVs and NSBs and this should > be > noted exactly in Fusion FAQ. > > Connected another question is: does ISS plan continue to support TPM > in > future? During my TPM usage I don't remmember any XPUs for it... > > Thank you. > --- > Best regards, Sergey V. Soldatov. > Information security department. > tel/fax +7 095 745 89 50 (1613) > > > > > "Kaylor, Adrian \(ISS > > Atlanta\)" To: "Pascual > Perez" <[EMAIL PROTECTED]>, > <[EMAIL PROTECTED]> > "[EMAIL PROTECTED]" <[email protected]> > Sent by: cc: > > [EMAIL PROTECTED] Subject: RE: > [ISSForum] Fusion module and checkpoint+cisco > > > > > 08.03.2005 17:54 > > > > > > > > > > There are currently no correlation items for Fusion for CheckPoint or > Cisco > logs. > > > > Thank you, > > Adrian Kaylor, CISSP > Technical Product Manager > Internet Security Systems > Phone: (404) 236-3052 > -----Original Message----- > From: [EMAIL PROTECTED] On Behalf Of Pascual Perez > Sent: Monday, March 07, 2005 5:38 PM > To: [EMAIL PROTECTED] > Subject: [ISSForum] Fusion module and checkpoint+cisco > > hi, can Fusion Module integrate the correlation with Checkpoint FW1 > and > CISCO logs?and how? > > thanks in Advance > > Pascual Alberto P�rez del Real > Azertia Consulting > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > > > > > > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/ _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
