How to perform network-wide
security event log monitoring
Using GFI EventsManager for intrusion detection and
essential auditing of security event logs
This white paper explains the need to monitor security event logs network-wide and how you can achieve this using GFI EventsManager (former GFI LANguard Security Event Log Monitor). It is written by Randy Franklin Smith, author of the in-depth series on the Windows security log in Windows 2000 & .NET Magazine.
WWW.GFI.COM How to perform network-wide security event log monitoring . 2
Introduction Microsoft Windows machines have basic audit facilities but they fall short of fulfilling real-life business needs (i.e., monitoring Windows computers in real-time, periodically analyzing security activity, and maintaining a long-term audit trail). Therefore, the need exists for a log-based intrusion detection and analysis tool such as GFI EventsManager. This paper explains how GFI EventsManager's innovative architecture can fill the gaps in Windows' security log functionality - without hurting performance and while remaining cost-effective. It discusses the use of GFI EventsManager to implement best practice and fulfill due diligence requirements imposed by auditors and regulatory agencies; and provides strategies for making maximum use of GFI EventsManager's capabilities.
About the writer: This white paper is written by Randy Franklin Smith, Windows event log monitor guru and writer of an in-depth series on the Windows security log for Windows 2000 & .NET Magazine (now Windows IT Pro Magazine).
Introduction....................................................................................................................................2 How GFI EventsManager works....................................................................................................2 Due diligence analysis...................................................................................................................6 Strategies to reap maximum value................................................................................................6 Select the proper security levels for computers ............................................................................6 Balance resource consumption with timely alerts .........................................................................7 Ensure security log maintenance and integrity .............................................................................7 Use file-access auditing for internal security.................................................................................8 Detect web server intrusion and defacement..............................................................................10 Hold administrators accountable.................................................................................................10 Create a long-term audit trail.......................................................................................................11 Conclusion...................................................................................................................................11 About GFI ....................................................................................................................................12
How GFI EventsManager works
Architectural overview GFI EventsManager performs intrusion detection and network security reporting by monitoring the security event logs of all Windows 2000/NT/XP/2003 servers and workstations in the organization. It alerts you in real time about possible intrusions and attacks.
To ensure proper integration with the overall Windows environment, GFI EventsManager uses standard Windows technology such as Microsoft Message Queuing (MSMQ), Microsoft Management Console (MMC), Microsoft Windows Installer, and Open Database Connectivity
WWW.GFI.COM How to perform network-wide security event log monitoring . 3
(ODBC).
Implementing network-wide monitoring with GFI EventsManager requires little effort because you don't need to install software on each computer you want to monitor. The administrator installs GFI EventsManager on only one host computer, and then simply regist... [download for more]
