In this video, I'd love to chat with you about logs. Now, logs as they're being
sent over to the
40 Analyzer currently in our environment, these three firewalls and this one as
well,
are all saying they're logs to our root administrative domain. So it's one
place we can go to to see
and work with all the logs. Now, as we send in logs or as the 40 gate sending
logs to the 40
Analyzer, there are different kinds of logs. We have traffic logs and a lot of
that depends
on whether or not in our firewall policies and our security policies that we
specify that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specify that we
want to logging on all traffic or not. So if we're not telling the 40 gates to
log the traffic,
they're not going to be sending that over to the 40 Analyzer. Another type of
log that we're
sending over is going to be security logs. So with the security logs, that'd be
a result of
having security profiles like IPS, application, web filtering, DNS and so forth
, that are associated
with firewall policies or security policies depending on how the 40 gate is
configured.
And those are also going to be sent over when they're matched on to the 40
Analyzer. There's also
event logs and unfortunately the word event, as we'll see in future videos on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event logs and unfortunately the word event, as we'll see in future videos on
the 40 Analyzer
means a whole nother thing, but event logs on a 48 firewall, that would be
things like a
configuration changes made by an administrator or the system was rebooted or an
administrator
logged in or logged out on the firewall, or if there's an HA event, a high
availability event
with a failover event, that would also be another example of an event type of
log. So the moment
these logs are sent over to the 40 Analyzer, and initially once they're sent
over, they're saved in
a dot log. However, after a moment or two, depending on how busy the 40 Analy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a dot log. However, after a moment or two, depending on how busy the 40 Analy
zer is, it's going to
take all that log information that's been receiving, it's going to actually add
it or inject it or
insert it into the SQL database. And at that point, we can actually see
additional information
about what's happening in the four to view section of 40 Analyzer. And again,
it shouldn't take that
long. We're talking, you know, sometimes just milliseconds for that to be added
, but on a very
busy 40 Analyzer, it could take a little bit of time. So to be aware initially,
when those logs
come in, you can see in the log view, and it may take a moment or two for them
to actually insert
it into the database. And then based on the configuration of the 40 Analyzer, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it into the database. And then based on the configuration of the 40 Analyzer,
after a period
of time logs are going to be archived. And at that point, we can go ahead and
still do log browsing
to see that information. But it's no longer available in tools like for the
view, and some of the
prebuilt views on the 40 Analyzer for logs that have been archived. And so when
they're archived,
they're compressed, and they have a dot gz extension. So again, still viewable
inside the 40 Analyzer
with the log browsing, however, not available in the other tools like for to
view. So if you need
to have that information in SQL database longer, which will be tweak and tune WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to have that information in SQL database longer, which will be tweak and tune
the settings in our
case for our root V DOM regarding the retention and how long we want to keep
logs. It's also
important to be aware that it's or some event or something's happening on the
network, we may have
to look at several different views and dig down into several different logs to
kind of triangulate
and confirm what's happening, because what if this computer right here is
sending a large amount of
data out to a country, you know, like India or Russia or Switzerland or
somewhere else? Is that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
somewhere else? Is that
okay? And the answer is, I don't know, it depends on the baseline of what
normal looks like. So
that's why it's a great idea to have a tool like 40 Analyzer, where we can
start building our
baselines and taking a look at what normal is. And if something looks abnormal,
we can dig deeper
into it and see what's going on. So along those lines, it'd be a great idea to
be aware and have
documented in our security operations center documented where our critical
systems are,
because of traffic, especially anomalous amounts of traffic or strange types of
traffic is going to
or from those critical systems that'd be more cause for alarm. We'd also want WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or from those critical systems that'd be more cause for alarm. We'd also want
to be aware of
what types of traffic are expected. We'd also want to be aware of the
quantities of traffic.
So for example, from this device right here, at the end of every month, maybe
there is a process
that's being driven for sending a whole bunch of data for end of month
reporting or some other
function, we'd want to be aware of that so we could document it. And that way,
when we see it,
we won't think, whoa, that's out of line with what normal is. And the beautiful
thing is that
the 40 Analyzer has a view of everything that's going on. So if we're not sure, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the 40 Analyzer has a view of everything that's going on. So if we're not sure,
you know, for
example, if that quantity of traffic is okay, we can take further steps into
researching it by
using another set of features called events and incidents, which we'll cover in
a separate set of
videos. But understanding what our baseline is and discovering that is an
important aspect to then
be able to identify what abnormal looks like. And in the next video, I'd like
to walk you through
some great techniques and options with the current flavor of 40 Analyzer on how
to do log
browsing and working with our logs that are coming in from our 4 to get devices
. So I'll see you in
the next video for exactly that.