Security Use Cases

Gary Long

Information Security Officer,

CernerWorks

Security issues, such as malicious software, hacking, internal or external fraud and policy violations still result in massive losses for organizations of all sizes. Financial losses from intellectual property theft are rising as well. In addition to hard dollar losses, security incidents can damage a company's reputation as well as alienate customers and partners, and even decrease the value of its stock.

With automated alerting, fast searching and reporting capabilities that provide greater network visibility and instant detection of malicious events, LogLogic improves security operations, incident management and forensics, helping to investigate security incidents and curb IP theft across your organization.

Security operations

As criminal hackers and malicious insiders endanger the ever-increasing range of corporate resources, fast and intelligent detection of their attacks using logs is more important than ever. One of the most effective means of knowing that your network has been attacked and possibly compromised by hackers is keeping aware of everything that happens on your networks, systems and applications at all times.

Keeping a pulse on your network is easier with LogLogic's real-time alerting and security-focused reporting. LogLogic's proven Log Learning technology delivers effective real-time behavioral analysis of logs and drives LogLogic alerting, so you can monitor log data in real time and receive early warning of abnormal log data patterns indicative of attacks and intrusions. Also, custom rules to drive alerting can be set up by the customers for any log type, including logs from custom and vertical applications.

Out of the box, LogLogic offers prepackaged security-focused reports, search queries and alerting rules that enable security analysts to quickly review and then drill-down on collected log data to accomplish common security operations tasks, from attack detection to investigations and control reviews.

Incident management

Highly stressful incident response environments call for immediate and correct answer to complicated questions: Who did what when? What other systems are affected? What users might be involved? What IP addresses need to be blocked immediately? What other things happened at the same time?

Perform rapid investigative queries using intuitive search-engine-like syntax (AND, OR, NOT, etc) and then drill-down into results to see original, unmodified log records that solve the problem at hand. LogLogic is the only log management tool that provides both fast reports based on parsed log data and even faster index searches based on a complete full text indexing of all collected logs – including logs from custom applications. Such index searches allow incident investigators to quickly cut through the volume of log data and unearth unambiguous evidence of investigated activities.

Forensic analysis

Perform rapid forensics with deep drill-down reports on log data using LogLogic’s parsing and indexing capabilities. LogLogic is the only log management tool that provides intelligent reports based on parsed log data while at the same time providing fast index searches based on a complete full-text indexing. Index searches allow forensic investigators to quickly cut through the volume of log data and unearth evidence of investigated activities while more in-depth, regular-expression-based searches allow looking for that elusive needle in the haystack.

Now you can also time-shift log data for re-analysis according to new rules and reporting requirements with Log Replay™ technology. Being able to auto-replay the log data flow lets you respond quickly after new rules, and even extend data analysis to examine new and old data together for greater business insight, predictive analysis and universal audit ability of any system activity.

Learn more