Enterasys Dragon: Intrusion Prevention System Log Analysis

Michael Patterson : Advanced NetFlow Traffic Analysis
Michael Patterson
Founder and Product manager for Plixer's Scrutinizer NetFlow and sFlow Analyzer as well as Flow Analytics.

Enterasys Dragon: Intrusion Prevention System Log Analysis

Network threat detection solutions generally share some common attributes with routers, switches, firewalls and even servers.  The one I want to focus on today is logging and specifically those from the Dragon Intrusion Prevention System.  If we can get the machine messages, in this case syslogs, from all systems into a somewhat similar format and in one location, we can then correlate the data and look for events across systems even if they perform very different functions on the network. In the end, this will improve network visibility and security event awareness.

Most Intrusion Prevention Systems (IPS) export some type of machine log which contains all kinds of details related to the threats detected or that match certain criteria.  Some IPS appliances are a bit more verbose and export details about every connection - kind of like NetFlow or IPFIX.  For example the export from the Dragon IPS includes the details shown in the following figure:


Notice in the above that several fields are similar to that exported by NetFlow capable switches.

  • dragonEventDateTime
  • sourceIPv4Address
  • destinationIPv4Address 
  • sourceTransportPort
  • destinationTransportPort
  • protocolIdentifier
The other fields that are enterprise specific to the IPS log export include:
  • dragonSensorName
  • dragonEventName
  • dragonEventDirection
  • dragonEventFlagsField
  • dragonEventHeader
  • dragonEventData

By leveraging IPFIXify, we can start exporting logs with IPFIX which supports a format similar to NetFlow.  We can then trend the events that occurred over time. Compare this to a top applications report using NetFlow, sFlow or IPFIX:

intrusion prevention system log analysis

By drilling in on one of the above Dragon “Event Names” or changing the report type, we can then view a report that looks very similar to another typical NetFlow trend. This is a great way to improve Dragon log reporting.

intrusion prevention system log monitoring 

Collecting and warehousing all of the logs generated by network gear in a standard format ensure greater visibility and security across the enterprise because it means we point and search in one place. 

Feedback for Enterasys Dragon: Intrusion Prevention System Log Analysis

Leave a comment

Featured Events