How To Analyze Events

By Author: Shirley Green
Total Articles: 129
Comment this article

After auditing requirements are analyzed and audit policies are configured, the security event logs will begin to collect MCTS Certification security events.What then? Logs are of no use unless they are collected, analyzed, and archived. You must determine the purpose of security event collection before establishing an audit policy. You must establish policies and procedures for reviewing the logs and analyzing the events. Analyzing event logs is not simply a process of reviewing events one by one in the logs. This is too time-consuming and might not reveal much useful information unless the reviewer is intimately familiar with each of the large number of events that can be issued and what combinations of events might mean. Instead of approaching security event logs as a large number of records to review, follow this process to analyze events:
1.Determine events or event combinations that will alert you to specific attacks.
2.Ensure that you are auditing for these free exam papers events.
3.Log and archive security event logs in ...
... a central location.
4.Filter logs for these events on a periodic basis, and set alerts. The time frame for analysis will depend on the sensitive nature of the events, the risk tolerance of the organization, and the current analysis of the likelihood of attack.Map event alerts to specific incident response procedures.

Example of Authentication A large number of authentication failures can mean an attack has occurred or is occurring. The threshold for recorded failure events will vary according to the number of user accounts and what is normal for your organization. The number of failed logon events that is normal for your organization depends on the sophistication of your users, the severity of your password policy, and the number of accounts users have. Other circumstances can also affect this number. You will have to audit failed logons for a while to determine what is normal. This number can change over time. The events that indicate failed logon are listed in MCITP Enterprise Administrator. You should filter security logs for these events.