Hi Davie,
Because you enabled every audit option, you will
get a lot of useless and some useful information. You
can extract this events using snare to a log server,
but you will still have to analyze all the data in
there. If you have multiple servers it is going to be
hard to do it manually (and snare has no correlation
on it)..
I would recommend you to try *OSSEC. It has a windows
agent that will extract your windows logs and forward
them (encrypted) to an analysis server. In your
log analysis server, you need install the ossec server
to receive this events from windows (or from linux).
On the log server, OSSEC will correlate your windows
logs, generate alerts, generate responses, etc.
More info:
http://www.ossec.net
Windows agents info:
http://www.ossec.net/en/manual.html#windows
*ossec is open source and I'm part of its development.
hope it helps,
--
Daniel B. Cid
dcid @ ( at ) ossec.net
-----Original Message-----
From: Davie Elliott - Eluse
[mailto:delliott@eluse.co.uk]
Sent: Sunday, May 21, 2006 8:27 AM
To: security-basics@securityfocus.com
Subject: MS Audit logs
Hi everyone,
I'm a bit of a newbie administrator, and I have a
quick question about
Microsoft windows audit logs.
Right now I have ticked every audit option in the
main GPO, so I get
tons of
audit objects to trawl through every week.
I was reading somewhere that MS Audit logs cycle or
something so after
24
hours I have lost some audit objects.
Also, I don't really know what I'm looking for in
the audits logs
anyway...
except for maybe checking if some users accounts
have been used when
they
shouldn't have.
Anyways, I was wondering what software would be good
for managing the
audit
logs?... I think I read a blog from an MS employee
saying someone should
use
3rd party software for managing the audit logs
instead of the built-in
windows thing.
Thanks for your help,
Davie.
_______________________________________________________
Abra sua conta no Yahoo! Mail: 1GB de espaço, alertas de e-mail no celular e
anti-spam realmente eficaz.
http://br.info.mail.yahoo.com/
