Once you've configured security logs we used group rules for the configuration and it's actively logging
events.
It's still only half a battle one the other half is browsing through the logs on a regular basis.
Many people enable the monitoring of large number of events in their systems but few actually read the
logs regularly.
As we said in one of the previous lectures the fundamental benefit to version strategy gives us is that
we have more time to detect an act of attack attempt.
During this time we need to be able to browse through the event logs.
If you only catch up with your logs once every two months this makes for a very optimistic assumption.
Unfortunately there is a very large amount of data in the logs and the used file format is quite unsightly.
This is why nobody ever wants to read the logs.
One way out could be provided by the use of additional tools for example such as log parser.
The parser enables us to retrieve data not only from event logs but also from system logs and other
applications.
This can be done through pseudo Eskew all queries.
You can specify your points of interest.
The computer from which logs are to be queried and the types of event information that should be retrieved
versatile tool also generates collective reports and presents them as DML reports
another feature of the utility groups certain event types selected groups can be later viewed in an
output chart form.
The solution might help you profile a normal user activity in your system's you'll be able to view the
log ons and log on ours and also see the average number of successful and failed attempts to access
specific files.
If you have a security baseline like that at your disposal you'll be more comfortable in detecting all
deviations from the pattern.
If there's no baseline untypical user behaviors or a change in the system behavior will be a lot harder
to pinpoint.
You'll not be able to tell if there is an attack or if the anomalies are simply due to increased user
activity.
For example a surge that occurs in the last week of a month
having collected the data.
You can audit user activity which means checking whether they conform to your security policy.
The logged events will help you detect various attacks including external attacks.
You can also investigate an attack and prepare evidence this topic will be covered in greater length
in a minute
the above picture shows an example of a query that retrieves events of a selected type from the security
log filters amusing as skewl expression.
In this case we're interested in Administrator account logons.