help you to understand what is happening on your network and machines by visualizing events in multi-dimensions with the help of parallel coordinates plot. It can handle million of events and the input language is easily scriptable. This way not only you can discover misuses of your network, but also write new IDS signatures based on the image facts.
What we are working on for the next Picviz.
Picviz is becoming more powerful: direct inclusion of logs, pcap, csv without going through the PGDL language. The engine has been completely rewritten and is way more efficient now to handle security events. Intensive abstract maths have been included to highlight correlations in multiple dimensions.
Darkreading has a story about Picviz.
The Honeynet Project has beefed up a free tool that helps spot attacks that can elude detection. The Picviz tool takes data from various log analysis sources and converts them into a multidimensional visual map of events.
Our "Know Your Tools: use Picviz to find attacks" whitepaper was released on November 25th 2009 as a PDF only. You can download the full paper from the link below.
