I just started as a security admin. I would like to know what are the things I should focus when reviewing firewall and IDP log files. We have juniper firewall and IDP devices. Any documentation / guidlines anyone can recommend.
Before scanning your logs (unless you're looking for specific traffic) you want to baseline, as described above. Consider also setting up a network monitoring tool to give you a more visual representation of your traffic -- MRTG or Nagios/NagVis etc
msaalim
ASKER
How would I know if a system has been compromised?