[FireEye]Highlighter Super Users Series: Post 2

[igor51]

Highlighter Super Users Series: Post 2

 

Back in November I published the first interview from the         target="_blank"
        href="/content/fireeye-www/en_US/services/freeware/highlighter.html"
      title="Highlighter">Highlighter™ Super Users blog series.
    My goal with this series is to shed some light on all the great
    things that can be achieved using this freeware tool. In part 2, I
    interviewed toolsmith author and       href="http://holisticinfosec.org/component/option,com_frontpage/Itemid,1/">HolisticInfoSec.org
    webmaster, Russ McRee.

    Super User Interview #2: Russ McRee

Russ McRee is the
    author of ISSA Journal's toolsmith series and runs
    HolisticInfoSec.org. In October 2011 Russ contacted me to discuss
    Highlighter in that month's issue of the ISSA Journal, and later for
    the nomination of Highlighter for the 2011 Toolsmith Tool of the
    Year. As someone who has analyzed Highlighter's effectiveness as
    a forensics tool for his own articles, I asked him to answer a few
    questions based on his experience with the freeware tool.

1. 
         Name
        
    Russ McRee
2. 
         Realm of work
        
    Security Analytics (security incident management, security
         monitoring, attack and penetration testing).
3. 
         How did you hear of Highlighter?
        
    I watch the websites and check for tool updates.
4. 
         Do you know of any other tools that do what Highlighter does?
        
    Log Parser, Log Parser Lizard, Log Parser Studio,
       Splunk
5. 
         How do you normally use Highlighter?
        
    I mainly use Highlighter for Log analysis, forensic
         investigations, demonstrations and research (see         target="_blank"
         href="http://www.youtube.com/watch?v=w0uOCOINrWY">http://www.youtube.com/watch?v=w0uOCOINrWY
         and     href="https://www.sans.org/reading_room/whitepapers/logging/evil-lens-web-logs_33950">https://www.sans.org/reading_room/whitepapers/logging/evil-lens-web-logs_33950)
6. 
         Can you describe one scenario in which Highlighter helped you
           find evil and/or solve crime?
        
    I had a recent mysterious case of core utility files and
         binaries gone missing from very important infrastructure
         management servers that initially looked malicious and
         intentional. Using Highlighter for analysis of Windows event logs
         led to the discovery of a sync job gone awry (misconfiguration) in
         the Application log via time stamp matching and keyword
       highlights.
7. 
         On a scale from 1 (worst) to 5 (best), how well does
           Highlighter address your use case(s)?
        
    4
8. 
         What is missing from Highlighter for your use case(s)?
        
    Word wrap option
9. 
         What is one Highlighter feature addition that would serve the
           Information Security community best?
        
    Potential DB support
10. 
          Are you aware of, or have you used, any of the following features:
         
    • 
                Activity Over Time feature that lets you view log data as a
                  function of Entries Per Day
               
       No, I was not aware.
    • 
                Hotkeys feature
               
       Yes, I was aware of this feature.
    • 
                Ability to change basic font settings for your output
               
       Yes, I was aware of this feature.
11. 
          Have you ever seen Highlighter used in such a way that your
            eyeballs melted from all the Awesome?
         
     My eyeballs melted from the awesome when I stuffed
          Highlighter with a 2.44GB Swatch log file during large file
          testing while writing October 2011's toolsmith. It took a
          little time to load and format (to be expected), but it handled
          24,502,412 log entries admirably (no choking). I threw a query for
          a specific inode at it and Highlighter tagged 1930 hits across 25
          million+ lines in ten minutes.

Keep an eye out for
    the final post in the Highlighter Super Users Series. If
    you're interested in sharing your own experiences with this tool,
    please let me know by commenting below.

Source: Highlighter Super Users Series: Post 2