4.2.2. Log Aggregation and SIEM
Syslog: Standard protocol for sending log messages. Devices send logs to a central collector for storage, search, and analysis.
SIEM (Security Information and Event Management): Correlates logs from multiple sources (firewalls, servers, applications) to detect security events. Provides:
- Centralized log storage
- Real-time correlation rules
- Alert generation
- Forensic investigation tools
- Compliance reporting
Packet Capture: Records actual network traffic (full content). Extremely detailed but storage-intensive. Used for deep analysis and forensics.
Deep Packet Inspection (DPI): Examines packet payloads, not just headers, to identify applications and content—deeper visibility than flow data, which records only conversation metadata.
Log Retention: Compliance can require keeping logs for years. Archive older logs to compressed, lower-cost cold storage rather than deleting them or lowering logging levels, and protect the archive (encryption, access control).
Port Mirroring (SPAN): Copies traffic from one or more switch ports to a monitoring port. Enables capturing traffic without being inline. For intermittent problems, leave SPAN (or flow export) feeding a collector continuously so the next event is recorded without someone watching for it.
