The CorreLog Server provides a standards-based method of collecting all
the system log messages of your network using syslog protocol
and SNMP traps. These messages are then correlated into understandable
threads, alerts, and actions using sophisticated (but easily configured)
rules, and reduced to actionable "tickets" that are sent to users, and
which can trigger automatic remediation of incidents.
The CorreLog Server provides special application in security monitoring
for your enterprise, and furnishes a variety of special functions and
features to support this critical role, including data encryption,
ready-to-run correlation rules and TCP tunneling software. Other roles
of CorreLog, including performance management, analysis of business
information, and log file analysis are also supported within the
(Download the brochure)
The CorreLog Server is specifically designed to leverage the
capabilities of your existing infrastructure without requiring
extensive installation of agents or other software. The program is
designed for high capacity, enterprise scale message aggregation, ease
of navigation, small footprint, extensibility, and high internal
security, available in a single web-based console.
- High Speed Message Reception. CorreLog is suitable
to operate as the single SNMP Trap and Syslog receiver for all devices
on the network of large enterprises. CorreLog can process more
than 2000 messages per second and can handle burst traffic of more
than 10,000 messages in one second (depending upon the supporting
hardware.) CorreLog tracks and catalogs devices on the network without
hard upper limit. You can receive messages from virtually unlimited
numbers of sources.
- High Speed Message Correlation. CorreLog uses an advanced
correlation engine, which performs semantic analysis of your messages
in real-time. The system employs correlation threads, correlation
counters, correlation alerts, and correlation triggers, which refine
and reduce your incoming messages into something you can easily
understand. We have pioneered various correlation techniques, and are
redefining the state-of-art in "semantic correlation".
- Flexible Reporting. CorreLog incorporates various reporting
facilities, including an Excel-based reporting facility that populates
spreadsheets with summary and detailed event information, and an ODBC
reporting facility that populates one or more databases with report
information to support third-party report writers. Additionally,
CorreLog includes a comprehensive dashboard facility, a "Pivot" log
analyzer (for analyzing firewall data, HTTP server logs, and other
"regular" data) and comprehensive graphing utilities useful for
reporting on correlation results. The CorreLog Server comes
preconfigured with compliancy reports and correlation rules to support
these reports. Additional report templates can be loaded (or saved)
using a built-in "Template" facility.
Data Aggregation and Archiving Functions. The CorreLog system can
aggregate vast amounts of data. It can collect in excess of 1 Gigabyte
of data each day at a single site, and save this data online for up to
500 days (given enough storage.) Additionally, CorreLog compresses and
archives your data, retaining this data for a period of more than 10
years (5000 days). To assist in forensics and long-term analysis,
CorreLog generates archival data such as MD5 checksums and Security
Data Searching Ability. One of the most important functions of
the CorreLog system program is its search capability. CorreLog uses its
proprietary GenDex (Generate Data Extraction) program, which employs a
high speed, real time index system. This allows quick searches through
massive amounts of message data. The performance of this engine rivals
the fastest search engines currently available. Users can search a
terabyte of data for a particular
keyword in less than one second.
Taxonomy, Ontology, and Catalog Functions. Taxonomy and
categorization of data is at the center of our unique correlation
system. The CorreLog Server automatically catalogs information by IP
address, username, facility, and severity. Users can further create
catalogs of information based upon simple or complex match patterns.
Data is cataloged based upon specifications consisting of simple
keywords, wildcards and regular expressions, logical expressions of
wildcards, macro definitions of regular expressions, and logical
combinations of macros. This provides a complete flexibility in
managing and grouping message data, while still maintaining high data
throughputs, and avoiding the rigors of data normalization.
Ability To Define New Syslog Facilities. One of the commonly
noticed limitations of Syslog protocol has always been that the
"Facility" codes (which define the data sources for syslog messages)
are limited to 24 predefined codes. The CorreLog program removes
this restriction, permitting users to define their own facilities, such
as "applications", and "devmsgs", so that data can be better categorized
and managed. This important extension to the syslog protocol opens
important new vistas in the practical use of Syslog messages and their
correlation, not otherwise available using the standard specification.
Ability To Override Message Content. One of the commonly noticed
limitations of SNMP Trap and Syslog protocol has always been that, since
messages are unsolicited, the message collector is stuck with whatever
message, severity, or facility was originally specified by the message
sender. In some cases the severities or facilities within a message may
be nonsensical. The CorreLog program recognizes this existing
limitation and implements a sophisticated "override" scheme, which
allows users to override the facility, severity, or device name in any
message. This greatly assists with the control and correlation of data.
Input Filtering. To reduce data loading, and permit precise
control over incoming messages, CorreLog can filter input data by
device, facility, severity, message keyword, time of day, or any
combination of these. Filtered data can be discarded, or put into a
separate repository (and possibly permanently archived) for further
analysis or forensics. When data is filtered, it is automatically
tagged with the particular filter expression, assisting in the analysis
of filtered data. CorreLog treats filtered data with respect,
permitting you to re-import discarded data and undo any particular
Automatic Remediation And Response. The CorreLog system
incorporates a simple and extensible "Actions" capability, which permits
you to target specific messages based upon device, keyword, facility,
severity and/ or time of day, and run programs on that data. The
CorreLog Server includes utility programs to update relational ODBC
databases, relay syslog messages, send SNMP traps, send e-mail, and
perform other actions. The facility is designed for easy extensibility
by administrators and developers to extend correlation and ticketing
services of the program.
Web Based Configuration. The CorreLog Server system is
entirely web-based. All activities, including the establishment of
logins and permissions, are completely achieved without a native
console. This means that an administrator does not ordinarily need
access to the CorreLog Server platform, except in rare instances to
startup or shutdown the process. The location of the CorreLog Server
can be strategically placed in a Network Operations Center (NOC)
or secure cabinet, which has important implications for security.
Suite of Utilities. The CorreLog Server
system incorporates a suite of Win32 utilities, in one small package
that is easily installed on Windows Vista, XP, or Windows 2000 servers.
These utilities are redistributable, and greatly extend the ability to
manage these platforms using Syslog protocol.
The CorreLog Server operates on a variety of Microsoft platforms,
including Windows Vista, XP, 200X, or Windows 7 systems.
The program does not require Java, or .NET, or a relational database
(although will take advantage of these components, if they are already
installed on the host or client platform.)
The CorreLog Server download package incorporates the Apache HTTP
server, easy Windows based installation dialog, a ready-to-run
configuration, and 500+ pages of indexed documentation in print-ready
Adobe PDF format.
The system also includes a copy of the CorreLog Windows Agent and
manual, so that users can easily add Syslog capability to an existing
Windows platform, thereby making the CorreLog Server full-enterprise
Importantly, the CorreLog Server system is designed for extremely easy
installation. A typical installation requires less than one minute, and
does not require the host platform to be rebooted.
Download CorreLog Evaluation Version Now... |
View Other Solutions & Services...