SPA Collector

The SPA Collector acts as an ‘analyzer’ and a ‘correlation engine’. Its main purpose is to analyze information and provide input to the SPA Engine to improve its policy and operation by processing the raw data provided by the engine and apply analysis techniques to define a proper short and long term reaction / action to the specific attack. It also functions as a monitoring and administration service for the operation of the SPA Engine via a web interface.

In addition to the SPA Engine, the SPA Collector can be integrated with various external security systems (i.e firewalls, ids etc) and receive security related logs in standard syslog format. Incoming logs are saved in a database, get analyzed using various parsers (Checkpoint, Snort,mod_security waf etc),correlated using 'spro' correlation engine and provide additional input to the SPA Engine.