HOPE 9: "Taking a bite out of logs with Sagan"
Channel: Da Beave
Date: 2012-07-21

Sagan is a open source (GPLv2) real time log analysis engine (syslog/MS Windows Event logs).  It's designed to take advantage of some of the Sourcefire "Snort" IDS/IPS functionality.  However,  Sagan is a complete separate project than Snort and the do not share the same code base.   Sagan allow network administrators to identify, correlate and block attacks based on logs analysis.  More information can be found at http://sagan.quadrantsec.com