Back in November I published the first interview from the Highlighter™ Super Users blog series.
My goal with this series is to shed some light on all the great
things that can be achieved using this freeware tool. In part 2, I
interviewed toolsmith author and HolisticInfoSec.org
webmaster, Russ McRee.
Super User Interview #2: Russ McRee
Russ McRee is the
author of ISSA Journal’s toolsmith series and runs
HolisticInfoSec.org. In October 2011 Russ contacted me to discuss
Highlighter in that month’s issue of the ISSA Journal, and later for
the nomination of Highlighter for the 2011 Toolsmith Tool of the
Year. As someone who has analyzed Highlighter’s effectiveness as
a forensics tool for his own articles, I asked him to answer a few
questions based on his experience with the freeware tool.
-
Name
Russ McRee -
Realm of work
Security Analytics (security incident management, security
monitoring, attack and penetration testing). -
How did you hear of Highlighter?
I watch the websites and check for tool updates. -
Do you know of any other tools that do what Highlighter does?
Log Parser, Log Parser Lizard, Log Parser Studio,
Splunk -
How do you normally use Highlighter?
I mainly use Highlighter for Log analysis, forensic
investigations, demonstrations and research (see http://www.youtube.com/watch?v=w0uOCOINrWY
and https://www.sans.org/reading_room/whitepapers/logging/evil-lens-web-logs_33950) -
Can you describe one scenario in which Highlighter helped you
find evil and/or solve crime?
I had a recent mysterious case of core utility files and
binaries gone missing from very important infrastructure
management servers that initially looked malicious and
intentional. Using Highlighter for analysis of Windows event logs
led to the discovery of a sync job gone awry (misconfiguration) in
the Application log via time stamp matching and keyword
highlights. -
On a scale from 1 (worst) to 5 (best), how well does
Highlighter address your use case(s)?
4 -
What is missing from Highlighter for your use case(s)?
Word wrap option -
What is one Highlighter feature addition that would serve the
Information Security community best?
Potential DB support -
Are you aware of, or have you used, any of the following features:
-
Activity Over Time feature that lets you view log data as a
function of Entries Per Day
No, I was not aware. -
Hotkeys feature
Yes, I was aware of this feature. -
Ability to change basic font settings for your output
Yes, I was aware of this feature.
-
Activity Over Time feature that lets you view log data as a
-
Have you ever seen Highlighter used in such a way that your
eyeballs melted from all the Awesome?
My eyeballs melted from the awesome when I stuffed
Highlighter with a 2.44GB Swatch log file during large file
testing while writing October 2011’s toolsmith. It took a
little time to load and format (to be expected), but it handled
24,502,412 log entries admirably (no choking). I threw a query for
a specific inode at it and Highlighter tagged 1930 hits across 25
million+ lines in ten minutes.
Keep an eye out for
the final post in the Highlighter Super Users Series. If
you’re interested in sharing your own experiences with this tool,
please let me know by commenting below.
