As any security administrator knows, the only thing as bad as not enough information is too much. Staying on top of the overwhelming flood of information from every device is a difficult job. Information comes in as events, alerts, notifications of changes or just status updates. Making sense of it all requires efficient correlation tools, like the Network Intelligence logging appliances.
Network Intelligence sent us the HA 2000, the smallest version of its enterprise-class product suite, fitting in between the EX series targeting SMEs, and the LS series for large environments. The system runs Windows 2000 Server in a 2U rack-mount chassis. The HA 2000 is licensed to handle a maximum of 2,000 events per second (EPS), from a maximum of 64 information sources. There are several larger versions available (chiefly a matter of licensing, although at 4,000 EPS the devices start shipping with more on-board disk and memory), up to 6,000 EPS, for monitoring up to 1,024 network devices. And they can be clustered, up to three units together for triple the throughput.
The SmartFilter product from Secure Computing was one of the earliest products to perform category-based URL filtering. Now in version 3.2, the basic principles of the product remain, with performance and management improvements aimed at making the task of controlling web access as simple as possible.
SmartFilter is intended to sit on a web proxy behind a firewall, or on the firewall itself. The product comprises agents that reside on the gateways, a management server that runs on Windows, Solaris and Linux servers, and a management console which can run on the same platforms. The server and console components are both Java based.
RealSecure 7.0 is the result of the integration between RealSecure and the BlackICE NIDS sensor technology. It runs on a dedicated machine and acts as a NIPS sensor to monitor a network segment, looking for intrusions or suspicious activity. If an intrusion is suspected, it can respond by recording details of the event. It can notify the network administrator, reconfigure the firewall, or terminate the event.