Harvesting security event logs..

[imported_nerve]

Hi,

I was wondering if anyone harvests security audit records off of pc's on a domain?

I currently use a script that harvests and puts them in a text file. I review them weekly.

Does anyone have any solutions for this?

I am currently running a w2k server and will be moving to a 2k3 box soon.

Any help would be great.

Thanks

 

[n0cmonkey]

If you have some Linux know how OSSEC HIDS can help with this.

For windows logs I've generally seen 3rd party syslog clients installed and pointed at a syslog server (generally running some *nix or proprietary software).

 

[HKSturboKID]

I use eventlog explorer. http://www.eventlogxp.com/features.html

 

[Chiefcrowe]

Thanks man, i will definitely check out eventlog xp!! i need something like this!

edit: on first use it looks pretty nice!!

 

[imported_nerve]

Thank you

 

[WobbleWobble]

If your network is a bit larger, a commercial Security Information and Event Management (SIEM) such as ArcSight will do the trick. They're not cheap though.

 

[n0cmonkey]

Originally posted by: WobbleWobble
If your network is a bit larger, a commercial Security Information and Event Management (SIEM) such as ArcSight will do the trick. They're not cheap though.

Especially when you throw in the full time people necessary to keep it running well.