Re: [logs] Re: What's normal?

Previous message: Richard Welty: "Re[2]: [logs] Logging: World Domination"
In reply to: Paul Ebersman: "Re: [logs] Re: What's normal?"
Next in thread: Anton A. Chuvakin: "Re: [logs] Re: What's normal?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

antonat_private

Hello Paul and all,

>Yup. This seems doable in finite time and gives a way for most sites
>to have a good baseline. I think we all realize that "normal" will
Hmm, the word finite seem to be key here. Finite, yes, but reeeeally long.

Any insights on how specifically you'd know what is normal for an
environment in one fell swoop?

Best,
-- 
  Anton A. Chuvakin, Ph.D., GCIA
     http://www.chuvakin.org
   http://www.info-secure.org

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
https://lists.shmoo.com/mailman/listinfo/loganalysis