Events & Meetings - Event View

Have you ever looked at the raw log files from Windows, Linux, IBM i, Cisco, and other devices and thought ‘Why can’t these log files make sense and speak the same language?’. During this session, Brad Mathis, a self-professed IBM i dummy, will review how a SIEM (Security Information and Event Management) system makes this a reality. You can even leverage it for your custom application logging. While all log data is unique, in its own way, and may make perfect sense to someone who is an expert in that specific discipline, it needs to make sense to all who are tasked with reviewing it. On that note, even if you are an expert in a specific field, wouldn’t it be nice if the gibberish found in raw log files could be translated into common metadata fields for easier interpretation. In this session, we will informally discuss this topic, keep the slideware to a minimum, and dive into a sandbox of the LogRhythm SIEM platform and try to see how easy it is to normalize and correlate log data in a common format.