Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

12:21 PM

List of Utilized Windows Logging Tools

By Anton Chuvakin

List of popular Windows logging tools on Catalyst Community. OSSEC and many low-end commercial tools are mentioned.

New posts appear first on Anton on Security on Medium. This blog keeps a copy, plus the archive going back to the mid-2000s.

Newer Older

Comments

Dr Anton Chuvakin Blog (Original)

This is Anton Chuvakin original blog (pre-Gartner) that I will now use to backup my Medium blog content (2023+)

The Last Blog Post!

This is my last blog post –for the foreseeable future. It is dated 7/31/2011 at 11:59PM. What happens tomorrow? A new life, of course! As only very few of you know, I have accepted a position of Research Director with Gartner, Inc . Tomorrow I am joining a stellar team lead by Phil Schacter , formerly from Burton Group . I spent two VERY successful years consulting , working with companies like Novell, RSA, LogLogic, NitroSecurity, eGestalt, ObserveIT, Tripwire, AlienVault, “Big MSSP”, “Big Insurance Company”, “SaaS Log Management Company”, “IT Management Software Company”, “SMB Security Company”, “Big Networking Equipment Company” and others. I defined, built, deployed, and marketed security products, mostly in the area of SIEM and log management . I helped organizations with security and PCI DSS strategy. I advised security vendor management on compliance strategy for their products. I have spoken at clients’ events and have written more whitepapers than I care to ...

Simple Log Review Checklist Released!

Today, many people are looking for very simple solutions to big and complex problems – and the area of logging and log management is no exception. Following that theme, we have created a " Critical Log Review Checklist for Security Incidents " which is released to the world today. In addition to HTML , PDF or DOC versions are available as well (alternative hosting location is here ). Feel free to modify the checklist for your own purposes or for internal distribution in your organization - but please keep the attribution to the authors. The log cheat sheet presents a checklist for reviewing critical system, network and security logs when responding to a security incident. It can also be used for routine periodic log review. It was authored by Dr. Anton Chuvakin and Lenny Zeltser (BTW, Lenny has other useful security cheat sheets on malware analysis, security architecture, DDoS, etc here ) Here is the embedded version from DocStoc: Critical Log Review C...

Why No Open Source SIEM, EVER?

Here is a perfect weekend post – on SIEM :-) Ok, all this Google web traffic of people searching for “ open source SIEM ” (sometimes “ open source SIM ”, almost never “open source SEM” {Is SEM .. dead? :-)}) continues to fill my web server logs and it finally prompted me to write this post, rather than simply whine about, like I was doing for 3 years :-) It all started here when Matasano folks (sockpuppet.org at the time), in a rare bout of punditry proclaimed back in 2005 (!): “A Credible Open-Source SIM I predicted that, just as SourceFire commoditized and co-opted the IDS market, a nascent open source project would challenge SIM products like ArcSight and Cisco MARS. Result: No Credit [A.C. – this is a later addition to their post when their scored their 2006 predictions] What’s taking you guys so long? Getting spooked that all the money seems to be going to log management? That’s exactly the dynamic Snort charged in to! Get with the program!” or in anothe...

Monthly Blog Round-Up – May 2017

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here ! “ Simple Log Review Checklist Released! ” is often at the top of this list – this aging checklist is still a very useful tool for many people. “ On Free Log Management Tools ” (also aged a bit by now) is a companion to the checklist ( updated version ) “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009. Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is h...

Monthly Blog Round-Up – January 2018

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts based on last month’s visitor data (excluding other monthly or annual round-ups): “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here – and we just UPDATED IT FOR 2018 . “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009 (oh, wow, ancient history!). Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is hard to explain – I suspect it has to do with people wanting “free stuff” and googling for “open source SIEM ” … A...

Topics

security1088 medium361 log management340 logging321 compliance237 PCI187 logs176 security management129 reading121 Monthly119 conference118 SIEM116 personal95 blogging92 trends91 humor86 musings83 presentation75 SIM67 SEM64 future47 news46 malware42 stupidity40 intrusion37 predictions36 chuvakin35 standards32 monitoring31 poll31 RSA30 book29 market29 incident28 SANS27 paper27 Medium26 loglogic26 risk24 tips23 warfare23 analytics21 CEE19 PCI_Log_Review19 marketing19 TysonRhame17 vendors17 cloud16 research16 ROI15 vulnerability15 honeynet14 privacy14 201013 book review13 forensics13 incident response12 metrics12 vulnerability management12 Annual11 DLP11 jobs11 big data10 philosophy10 review10 TysonRhame9 20099 Gartner Archive9 Medium Backup9 data protection9 podcast9 websec9 Gartner8 business8 economics8 saas8 strategy8 webinar8 Information Security7 awareness7 career7 insiders7 legal7 network forensics7 20086 BlackHat6 Detection Engineering6 application6 attack6 LogChat5 consulting5 database5 endpoint5 haiku5 myth5 policy5 product management5 qualys5 security theater5 software5 virtual5 20074 FAIL4 encryption4 mistakes4 patching4 search4 soc4 travel4 virtualization4 visualization4 web logs4 windows4 20113 DRM3 GRC3 MSSP3 NIST3 ai-soc3 audit3 awesomeness3 correlation3 government3 interview3 intrusion detection3 open source3 opsec3 perimeter3 politics3 pontification3 questions3 security-operations3 siem3 20122 20202 HIPAA2 Security Operations2 ShmooCon2 access2 ai2 ai-security2 best practices2 competitive2 cybercrime2 e-discovery2 evangelism2 glossary2 keynote2 knowledge management2 new2 rootkit2 security-operation-center2 stratfor2 tools2 twitter2 0day1 20131 20191 Android1 Cloud Security1 Cloud Threats1 EMAP1 IANS1 IPv61 SOC1 Security Monitoring1 Uncategorized1 analogy1 announcements1 architecture1 authentication1 blo1 collective1 comments1 computers1 controversy1 cool1 current1 data1 data mining1 fraud1 geopolitics1 guest post1 identity1 innovation1 linux1 mobile1 obvious1 platform1 quarterly-blogging1 reflections1 security-basics1 semantic1 sharing1 storage1 threat intelligence1 video1 vulnerability-management1 whitepaper1

2026 26
- September 3
- August 6
- July 3
- June 2
- May 4
- April 3
- March 4
- January 1
2025 37
- December 4
- November 2
- October 2
- September 12
- August 1
- July 4
- June 2
- May 1
- April 1
- March 2
- February 1
- January 5
2024 57
- December 4
- November 1
- October 5
- September 2
- August 3
- July 7
- June 3
- May 4
- April 7
- March 9
- February 9
- January 3
2023 58
- December 5
- November 5
- October 10
- September 6
- August 7
- June 3
- May 10
- April 2
- March 6
- February 2
- January 2
2022 55
- December 2
- November 5
- October 5
- September 1
- August 4
- July 3
- June 9
- May 3
- April 10
- March 3
- February 3
- January 7
2021 42
- December 3
- October 1
- September 3
- August 3
- July 2
- June 1
- May 4
- April 9
- March 9
- February 4
- January 3
2020 88
- December 5
- November 7
- October 6
- September 16
- August 7
- July 4
- June 4
- May 10
- April 7
- March 6
- February 9
- January 7
2019 36
- December 11
- November 2
- October 3
- September 2
- August 5
- July 6
- June 5
- May 2
2018 8
- August 2
- July 1
- June 1
- May 1
- March 1
- February 1
- January 1
2017 12
- November 1
- October 1
- September 1
- August 1
- July 1
- June 1
- May 1
- April 1
- March 1
- February 1
- January 2
2016 16
- December 3
- November 1
- October 1
- September 1
- August 1
- July 1
- June 1
- May 1
- April 1
- March 1
- February 2
- January 2
2015 15
- December 1
- November 1
- October 1
- September 1
- August 3
- July 1
- June 1
- May 1
- April 1
- March 1
- February 1
- January 2
2014 35
- December 1
- November 2
- October 4
- September 1
- August 1
- July 7
- June 6
- May 4
- April 3
- March 4
- February 1
- January 1
2013 53
- December 4
- November 2
- October 6
- September 7
- August 4
- July 7
- June 4
- May 2
- April 3
- March 4
- February 6
- January 4
2012 46
- December 4
- November 3
- October 2
- September 5
- August 5
- July 8
- June 2
- May 2
- April 2
- March 5
- February 4
- January 4
2011 73
- December 1
- November 2
- October 5
- September 2
- August 2
- July 12
- June 4
- May 8
- April 6
- March 10
- February 8
- January 13
2010 137
- December 22
- November 12
- October 6
- September 11
- August 15
- July 7
- June 6
- May 10
- April 10
- March 14
- February 15
- January 9
2009 193
- December 11
- November 12
- October 23
- September 16
- August 15
- July 13
- June 18
- May 11
- April 20
- March 19
- February 14
- January 21
2008 311
- December 18
- November 20
- October 23
- September 15
- August 19
- July 19
- June 22
- May 28
- April 45
- March 27
- February 33
- January 42
2007 479
2006 370
- December 24
- November 25
- October 24
- September 31
- August 34
- July 31
- June 23
- May 20
- April 52
- March 41
- February 33
- January 32
2005 34
- December 34

My Links

"PCI Compliance" book site
My website
My old presentations
My old portal Info-Secure.org
Old "Security Warrior" Book Site