Dr Anton Chuvakin Blog (Original)

Security writing since the mid-2000s. New posts are mirrored from Anton on Security on Medium.

Read on Medium LinkedIn X RSS

5:02 PM

On Visualization

By Anton Chuvakin

Ah, maybe somebody other than Raffy will benefit from it too :-)

New posts appear first on Anton on Security on Medium. This blog keeps a copy, plus the archive going back to the mid-2000s.

Comments

Dr. Anton Chuvakin

Security at Cisco. Before that: Google Cloud Office of the CISO, eight years as a Gartner analyst, and a long run in SIEM and log management. Author of Security Warrior, PCI Compliance, and Logging and Log Management.

Dr Anton Chuvakin Blog (Original)

This is Anton Chuvakin original blog (pre-Gartner) that I will now use to backup my Medium blog content (2023+)

Top Popular Posts

The Last Blog Post!

This is my last blog post –for the foreseeable future. It is dated 7/31/2011 at 11:59PM. What happens tomorrow? A new life, of course! As only very few of you know, I have accepted a position of Research Director with Gartner, Inc . Tomorrow I am joining a stellar team lead by Phil Schacter , formerly from Burton Group . I spent two VERY successful years consulting , working with companies like Novell, RSA, LogLogic, NitroSecurity, eGestalt, ObserveIT, Tripwire, AlienVault, “Big MSSP”, “Big Insurance Company”, “SaaS Log Management Company”, “IT Management Software Company”, “SMB Security Company”, “Big Networking Equipment Company” and others. I defined, built, deployed, and marketed security products, mostly in the area of SIEM and log management . I helped organizations with security and PCI DSS strategy. I advised security vendor management on compliance strategy for their products. I have spoken at clients’ events and have written more whitepapers than I care to ...

Simple Log Review Checklist Released!

Today, many people are looking for very simple solutions to big and complex problems – and the area of logging and log management is no exception. Following that theme, we have created a " Critical Log Review Checklist for Security Incidents " which is released to the world today. In addition to HTML , PDF or DOC versions are available as well (alternative hosting location is here ). Feel free to modify the checklist for your own purposes or for internal distribution in your organization - but please keep the attribution to the authors. The log cheat sheet presents a checklist for reviewing critical system, network and security logs when responding to a security incident. It can also be used for routine periodic log review. It was authored by Dr. Anton Chuvakin and Lenny Zeltser (BTW, Lenny has other useful security cheat sheets on malware analysis, security architecture, DDoS, etc here ) Here is the embedded version from DocStoc: Critical Log Review C...

Why No Open Source SIEM, EVER?

Here is a perfect weekend post – on SIEM :-) Ok, all this Google web traffic of people searching for “ open source SIEM ” (sometimes “ open source SIM ”, almost never “open source SEM” {Is SEM .. dead? :-)}) continues to fill my web server logs and it finally prompted me to write this post, rather than simply whine about, like I was doing for 3 years :-) It all started here when Matasano folks (sockpuppet.org at the time), in a rare bout of punditry proclaimed back in 2005 (!): “A Credible Open-Source SIM I predicted that, just as SourceFire commoditized and co-opted the IDS market, a nascent open source project would challenge SIM products like ArcSight and Cisco MARS. Result: No Credit [A.C. – this is a later addition to their post when their scored their 2006 predictions] What’s taking you guys so long? Getting spooked that all the money seems to be going to log management? That’s exactly the dynamic Snort charged in to! Get with the program!” or in anothe...

Monthly Blog Round-Up – May 2017

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here ! “ Simple Log Review Checklist Released! ” is often at the top of this list – this aging checklist is still a very useful tool for many people. “ On Free Log Management Tools ” (also aged a bit by now) is a companion to the checklist ( updated version ) “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009. Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is h...

Monthly Blog Round-Up – January 2018

Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts based on last month’s visitor data (excluding other monthly or annual round-ups): “New SIEM Whitepaper on Use Cases In-Depth OUT!” (dated 2010) presents a whitepaper on select SIEM use cases described in depth with rules and reports [using now-defunct SIEM product]; also see this SIEM use case in depth and this for a more current list of popular SIEM use cases. Finally, see our 2016 research on developing security monitoring use cases here – and we just UPDATED IT FOR 2018 . “ Why No Open Source SIEM, EVER? ” contains some of my SIEM thinking from 2009 (oh, wow, ancient history!). Is it relevant now? You be the judge. Succeeding with SIEM requires a lot of work, whether you paid for the software, or not. BTW, this post has an amazing “staying power” that is hard to explain – I suspect it has to do with people wanting “free stuff” and googling for “open source SIEM ” … A...

Topics

security1167 medium363 log management340 logging331 compliance239 PCI187 logs176 security management129 SIEM128 conference122 reading121 Monthly119 Information Security102 personal95 blogging92 trends91 humor86 Gartner Archive84 musings83 presentation75 SIM67 SEM64 monitoring64 future50 news46 malware42 analytics40 stupidity40 intrusion37 predictions36 chuvakin35 standards35 poll31 RSA30 Security Operations29 book29 market29 incident28 SANS27 paper27 Medium26 loglogic26 philosophy26 risk24 tips23 warfare23 cloud22 CEE20 PCI_Log_Review19 marketing19 big data18 incident response18 TysonRhame17 vendors17 research16 vulnerability16 DLP15 ROI15 honeynet14 privacy14 201013 book review13 forensics13 metrics12 vulnerability management12 Annual11 jobs11 threat intelligence11 review10 TysonRhame9 20099 MSSP9 Medium Backup9 data protection9 podcast9 websec9 Gartner8 application8 business8 economics8 network forensics8 saas8 strategy8 webinar8 awareness7 career7 insiders7 legal7 policy7 20086 BlackHat6 Detection Engineering6 attack6 data6 siem6 soc6 LogChat5 consulting5 database5 endpoint5 haiku5 myth5 network-forensics5 patching5 product management5 qualys5 security theater5 software5 virtual5 20074 FAIL4 encryption4 incident-response4 mistakes4 search4 soar4 travel4 virtualization4 visualization4 vulnerability-management4 web logs4 windows4 20113 20203 DRM3 GRC3 NIST3 SOC3 ai3 ai-soc3 audit3 awesomeness3 correlation3 detection3 government3 interview3 intrusion detection3 network3 nta3 open source3 opsec3 orchestration3 perimeter3 politics3 pontification3 questions3 security-operations3 20122 HIPAA2 Incident Response2 ShmooCon2 Threat Intelligence2 access2 ai-security2 announcement2 best practices2 collective2 competitive2 cybercrime2 e-discovery2 evangelism2 glossary2 keynote2 knowledge management2 mssp2 new2 rootkit2 security-operation-center2 sharing2 stratfor2 tools2 twitter2 ueba2 0day1 20131 20191 Android1 Artificial Intelligence1 Career1 Cloud Security1 Cloud Threats1 EMAP1 Future Trends1 Gartner Research1 IANS1 IPv61 Log Management1 Metrics1 Risk Management1 Security Monitoring1 Uncategorized1 Vulnerability Management1 analogy1 announcements1 architecture1 authentication1 blo1 comments1 computers1 controversy1 cool1 current1 data mining1 data-and-analytics-strategies1 data-security1 deception1 discovered-link1 dlp1 fraud1 gartner1 geopolitics1 guest post1 identity1 innovation1 linux1 mobile1 obvious1 patch-management1 platform1 quarterly-blogging1 reflections1 related-blog1 security-basics1 security-monitoring1 semantic1 storage1 threat-intelligence1 video1 vulnmgt1 vulnops1 whitepaper1

2026 28
- October 2
- September 3
- August 6
- July 3
- June 2
- May 4
- April 3
- March 4
- January 1
2025 37
- December 4
- November 2
- October 2
- September 12
- August 1
- July 4
- June 2
- May 1
- April 1
- March 2
- February 1
- January 5
2024 57
- December 4
- November 1
- October 5
- September 2
- August 3
- July 7
- June 3
- May 4
- April 7
- March 9
- February 9
- January 3
2023 58
- December 5
- November 5
- October 10
- September 6
- August 7
- June 3
- May 10
- April 2
- March 6
- February 2
- January 2
2022 55
- December 2
- November 5
- October 5
- September 1
- August 4
- July 3
- June 9
- May 3
- April 10
- March 3
- February 3
- January 7
2021 42
- December 3
- October 1
- September 3
- August 3
- July 2
- June 1
- May 4
- April 9
- March 9
- February 4
- January 3
2020 88
- December 5
- November 7
- October 6
- September 16
- August 7
- July 4
- June 4
- May 10
- April 7
- March 6
- February 9
- January 7
2019 54
- December 11
- November 2
- October 3
- September 2
- August 5
- July 6
- June 10
- May 6
- April 3
- March 5
- February 1
2018 39
- December 1
- November 4
- October 4
- September 3
- August 4
- July 4
- June 5
- May 4
- March 4
- February 5
- January 1
2017 33
- December 1
- November 3
- October 5
- September 2
- August 3
- July 2
- June 2
- May 2
- April 4
- March 1
- February 2
- January 6
2016 36
- December 4
- November 4
- October 2
- September 2
- August 1
- July 3
- June 1
- May 3
- April 2
- March 4
- February 5
- January 5
2015 50
- December 3
- November 4
- October 7
- September 1
- August 8
- July 3
- June 4
- May 2
- April 4
- March 4
- February 5
- January 5
2014 58
- December 5
- November 3
- October 6
- September 4
- August 1
- July 8
- June 6
- May 5
- April 3
- March 8
- February 4
- January 5
2013 70
- December 4
- November 4
- October 8
- September 7
- August 5
- July 12
- June 5
- May 4
- April 5
- March 5
- February 6
- January 5
2012 66
- December 9
- November 5
- October 2
- September 6
- August 7
- July 9
- June 3
- May 2
- April 3
- March 8
- February 7
- January 5
2011 74
- December 1
- November 2
- October 6
- September 2
- August 2
- July 12
- June 4
- May 8
- April 6
- March 10
- February 8
- January 13
2010 137
- December 22
- November 12
- October 6
- September 11
- August 15
- July 7
- June 6
- May 10
- April 10
- March 14
- February 15
- January 9
2009 193
- December 11
- November 12
- October 23
- September 16
- August 15
- July 13
- June 18
- May 11
- April 20
- March 19
- February 14
- January 21
2008 311
- December 18
- November 20
- October 23
- September 15
- August 19
- July 19
- June 22
- May 28
- April 45
- March 27
- February 33
- January 42
2007 479
2006 370
- December 24
- November 25
- October 24
- September 31
- August 34
- July 31
- June 23
- May 20
- April 52
- March 41
- February 33
- January 32
2005 34
- December 34

My Links

"PCI Compliance" book site
My website
My old presentations
My old portal Info-Secure.org
Old "Security Warrior" Book Site

Powered by Blogger

Copyright Anton Chuvakin

© Anton Chuvakin. Opinions are my own. Anton on Security · Atom feed