ManageEngine, the real-time IT management company, announced dramatic improvements to the correlation engine of†EventLog Analyzer, its network log management solution. The upgraded engine is faster, provides finer control and correlates information from multiple devices across a network to uncover complex security attacks.
Log correlation involves identifying a sequence of related logs that constitute a single incident. Doing this across disparate log formats from various devices is a challenge. EventLog Analyzer solves this by efficiently comparing different types of logs and finding possible attack patterns. Field-level correlation gives users the power to specify various ways to relate logs, allowing them to create well-defined rules and reduce false positives.
“Network attacks progress in a series of steps, involving several devices on a network. Often, businesses are left scrambling to pick up the pieces and find out how an attack transpired only after the fact,” said Manikandan Thangaraj, director of product management at ManageEngine. “The main advantage of collecting logs from all devices in one central location is that you can put them together to discover the larger picture and proactively defend against potential threats.”
Proactive Threat Mitigation with Log Correlation
EventLog Analyzer’s correlation module boasts several new features and improvements:
- Intuitive dashboard: Get a bird’s-eye view of every attack discovered on a network. Delve into specific incidents with the timeline view, which shows the sequence of events leading up to an incident.
- Custom rule builder: Build complex, custom rules to detect specific network activity. Use more than 250 network actions, specify time frames between actions and define field-level conditions for finer control. Twenty-five predefined correlation rules are also included in the product.
- Integrated incident management: Assign correlation incident tickets to owners and track their status from within the EventLog Analyzer console, or forward the tickets to popular help desk software.
Pricing and Availability
EventLog Analyzer version 11.8 is available for immediate download. The solution is licensed based on the number of log sources monitored. The base pack of EventLog Analyzer monitors 10 log sources and is available for $495.
