06/08/15 - The Firewall Monitoring use case has been updated. Firewall Monitoring 1.2 provides improved content and performance, as well as additional resources:
- The dashboards have been improved to help monitor traffic to and from suspicious countries, and monitor real time device configuration updates in addition to login activity.
- Two reports have been added to provide information about traffic to and from suspicious countries.
- Additional rules have been added to support the updated dashboards and new reports.
04/15/15 - This Use Case covers abnormal traffic detected by perimeter firewalls. This enables Firewall log analysis for security information and event management tool from ArcSight that collects, analyzes, and reports on enterprise-wide firewalls from any vendor. Firewall Intrusion Monitoring helps you to:
- Manage heterogeneous Firewall devices from many vendors and many versions.
- Centralized repository for all the collected Firewall logs.
- Quick forensics on Firewall logs correlated with user and apps data.
- Dashboard and Active Channels for Firewall analytics use case.
- Visualize top denied destination ports and hosts.
- Analyze failed and successful logins to a Firewall device.
- Internal and external traffic on the network that is blocked by a Firewall.
Microfocus ArcSight Connectors supported:
- ArcSight Reputation Security Monitoring (RepSM)
- Check Point FW-1
- Cisco PIX Firewall
- Cisco PIX/ASA Syslog, version 8.5, 8.6
- F5 BIG-IP Application Security Manager
- Juniper Networks (Altor Networks Virtual Firewall)
- Juniper Network Security Manager (NetScreen)
- Juniper Network Security Manager Syslog, version 2011.4
- Juniper Networks Firewall and VPN
- Lucent Managed Firewall
- McAfee Desktop Firewall
- Secure Computing Gauntlet Firewall/ VPN
