To wrap up this set of videos regarding events on the 40 Analyzer,
I like to propose a customer scenario and that's this. A customer that has
hired us to come in and
consult for them, they're confused about the distinction between events on a 40
-gate firewall,
for example, like firewall one, and events on the 40 Analyzer. So my question
for you is,
as we're going to go meet with the customer, you and I should have a little pow
wow first
before we go chat with them. And my question is, how would you explain the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
before we go chat with them. And my question is, how would you explain the
differences
with the events on the 40-gate versus the events on the 40-analyzer to the
customer?
So here's what I would love you to do right now. Go ahead and pause the video,
think about how you would best explain it to the customer, and then when you're
ready,
I'd like you to hit resume and we can talk about it together in preparation for
meeting with that
customer. So let's have a little pregame meeting before we meet with the
customer.
A couple of thoughts. Number one, we probably want to just chat with them about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A couple of thoughts. Number one, we probably want to just chat with them about
the log messages
on the 40-gate by itself, which when it sends those over to the 40-analyzer,
those are going to be
sent over as raw logs, and then 40-analyzer is going to do a few things with
them. But on the local
40-gate firewall, the events would be like security events, web filtering,
application control,
DNS, and so forth. But at that point, they're just logs. So we can say that the
40-gate is going
to go ahead and send those logs over to the 40-analyzer. Now, we probably don't
need to tell the customer
that the 40-analyzer receives those as raw log events and then puts them into a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that the 40-analyzer receives those as raw log events and then puts them into a
SQL database.
You and I know that, but the customer may not care about that too much. However
, what they would
care about is that we could tell them that the 40-analyzer has a set of rules
that it's looking
at regarding incoming log messages. And let me rewrite rules there to make it
look like rules.
Rules, there we go. And so based on those rules with things that are happening
with those log
events, for example, like administrator failing to log in a certain number of
times, or a 40-gate
firewall that's blocking DNS requests to a malicious domain based on the 40- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall that's blocking DNS requests to a malicious domain based on the 40-
analyzer,
seeing those logs and then comparing against the rules, it's then going to go
ahead and then
create events on the 40-analyzer that can then be used to see what's happening.
Now, if we wanted
to, we could also give them a little extra info and see that these rules that
are being looked at
on the 40-analyzer that are creating the events, we could let them know that
what's created those
events is called the event handlers. And then furthermore, once we watch the
next skill that is,
you and I could then tell them also that based on all these events, we could WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you and I could then tell them also that based on all these events, we could
then organize them
into tickets. Now, in the world of 40-analyzer, they call those tickets "inc
idents." And the
great news about "incidents and incident management" is that's the exact next
topic that we're going
to talk about in our next set of videos, in our next skill. And I look forward
to seeing you, my
friend, in the next skill in the near future. But until then, I hope this has
been informative,
and I'd like to thank you for viewing.