Simple Event Correlator

A simple event correlator is a form of event correlation that is written entirely in the programming language PERL. It is a light version of a full event correlation software. Like a standard event correlation tool, a simple event correlator can manage security, monitor, track, and analyze events in your log files. Unlike the full, often more expensive event correlation solutions, a simple event correlator is independent from any specific platform and runs itself as a single process. It can be deployed in various places on your network, such as terminals or various shell pipelines, allowing it to run many processes at the same time for a variety of tasks.

Core Features

Primarily, the simple event correlator is designed to find event patterns set up by specific rules in configuration files. It offers advanced features such as log file analysis and logic analysis, making it suitable for traditional event correlation tasks. One common use case is monitoring and preventing brute force attacks on your system by placing a process in your login event file to watch for repeated failed login attempts and notify you of such events.

Flexibility

The draw for using a simple event correlator over traditional event correlation tools is its flexibility. It can handle event logs from many different contexts, differentiating it from others and making it appealing to IT professionals. For example, consider a scanner that continually jams; a traditional tool would send an email for every jam, while the simple event correlator can recognize that an email has already been sent and prevent inbox flooding.

Concurrent Operations

Rules can be set to begin event correlation operations continuously while simultaneously running rules that react automatically in real-time to specific events or at set times based on your network’s internal clock. For instance, if set up to monitor log files for specific events, and you are looking at configuration files for a rule on failed logins, the correlator will recognize these events and display relevant messages for your team.

Context Feature

Another key feature is the context. At its foundation, a context is a memory tool, which can have multiple titles, serve as an event store, and have a limited lifespan. Contexts can aggregate events and report them in real time or as a daily summary. Additionally, you can set up an action list to execute automatically if the context nears expiration.