Logging and Monitoring to Detect Network Intrusions and Compliance Violations in the Environment

Log Management and Intrusion Detection solutions have been evolving for years. Yet, it remains a challenge for organizations of all sizes to meet the operational, audit and security needs using these solutions. This paper presents a solution to bridge logging, log based intrusion detection and network based intrusion detection using well known free open source tools available on the Security Onion Linux Distribution. It walks through the logging, monitoring and alerting approach necessary for security, compliance and quality of service. In the process it provides for cost effective, customizable and scalable solution alternative to vendor based Security Information and Event Management (SIEM) solutions.