Security Monioring Best Practices with Orion

Question

Our company just purchased Orion and Orion APM  but have not yet started the implementation.  I have evaluated the products enough to be pretty familiar with how they work and how things are configured.

Our company has a data-center and provides ISP, Colo, and Managed Services.

I am curious what other people are doing as far as using Orion for security monitoring for both network and servers.

Thanks in advance for any feedback!

byrona · Answer

Thanks for your respone.  I would be curious to know what you do with Syslog?  Do you use the Orion tools for this or do you use other tools as well?  We currently do some Syslog monitoring but I would love to hear what you are doing, thanks again!

jswan · Answer

One non-technical thing you can do is make sure that if you have separate NOC and security teams, that they are somewhat cross-trained and talk to each other a lot. My experience has been that security tools often illuminate network operational problems, and vice versa.

From a technical perspective, two of your most valuable sources of security information are syslog and Netflow. Some security people focus almost exclusively on firewall and NIDS/HIDS data, which is a big mistake IMO. You will find a lot of important security data in syslog and in Netflow statistics, and anything you can do to make that data easily available and searchable will be time well spent.