Now the one last thing that I want to show.
We had said that this is the minimum that I would recommend people turn on,
but there are a lot of other logs.
And someone may not know exactly what they want to do,
so there is one tool that will actually show that for you.
So there's a tool called LOG-MD, so I'm just going to go to that.
LOG-MD is a great tool.
It can be used to actually analyze your logs,
but we're going to use it a little bit differently.
If you run it by default, and you don't have proper logging set on,
it actually won't run,
but it spits out an audit file that tells you what you need to turn on.
So I don't have proper logging set up on this, so I'm going to run logmd.
It's going to go and it's going to say hey,
you don't have the right logs turned on.
Look at this file, the Report_Audit_Settings file.
So let me open that up.
The log doctor is giving you his analysis of what's wrong with your stuff.
And this is a free tool as well.
So I'm going to open that up.
And here, we see it telling us that we don't have the log sizes correctly,
but here are the commands that you need in order to do that.
So that what we had talked about before and the size of your logs as well.
And right here is where it shows you here are the different
types of logs that need to be turned on based off of the
different best practices that are out there,
and this is what your PC is set to.
Is that Center for Information Security, the CIS standards?
Yes, the CIS standards, and some Australian,
and Great Britain, and just all of these different standards.
So this is a great tool as well to go in and just see what you need to turn on.
Yeah, I like this a lot.
I can even see there's a way this could be pulled,
ran remotely, and then pulled in, and then see if someone is changing your logs.
It all runs locally.
Yeah, you could deploy it, have a script run as a scheduled task,
and then look to see where things have been changed.
Yeah, because as an intelligent insider,
I may know that you're logging stuff and kind of change stuff so you
can't catch me doing things I'm not supposed to do,
company policy violations, or whatever worse.
That's really neat.