Logsign Windows Auditing

All Rights Reserved - Logsign 2015
Windows Auditing
Security Information and Event Management
LOGSIGN V4.0
WORKSHOP
All Rights Reserved - Logsign 2015

All Rights Reserved - Logsign 2015 www.logsign.com http://support.logsign.com
Overview
We always have to figure out the critical changes on our systems through finding
the answers to these questions.
They are the same for everyone:
● Who did it?
● What was changed?
● When? and
● Where?
System administrators should be ready and prepared to address such issues.

Agenda
● Windows Security Event Categories
● Windows Events and Logsign’s Event Mapping Technique
● Windows Policy and Tracking Suggestions
● Compliance Reporting
● Advantages of Logsign on Windows Auditing Environment

Security Event Categories
Main categories of Windows OS are:
● Account Logon
● Account Management
● Logon/Logoff
● DS Access
● Object Access
● Policy Change
● Privilege Use
● System
Logsign provides predefined reports related to Windows Security Event
Categories.

Windows Events & Logsign
Logsign tracks all security events, normalizes and classifies according to smartly
designed event mapping technique as it is also called taxonomy. Subsequently
Logsign is able to provide event category-based reporting.

Logsign’s Event Mapping
Logsign classifies all events in their
related categories regarding to
event mapping structure.
Monitoring the events and better
understanding are available with
this categorization.
Advanced event mapping
technique is also applied to
Windows environment.

Policy and Tracking Suggestions
Logsign collects events and normalize them when Windows Auditing is activated.
To keep the tracking of events occurring in the Windows environment, the rules in
"Local Policy" must be active.

Policy and Tracking Suggestions
Everyone can be an attacker. Start auditing ACLs when you need to check before
authorization.
You can select any types of permission as you can see below, for a group or
single person to be monitored.

Compliance & Reporting
Logsign provides hundreds of dashboards, alerts and reports on Windows
environment. They are fully pre-defined and ready to download. The pre-defined
dashboards and reports provide real-time monitoring and detection.
Reports are also designed and automated to meet all the international compliance
requirements.
● PCI DSS
● ISO 27001
● FISMA
● HIPAA
● SOX
● NERC
● GLBA
● 5651

Advantages of Logsign
Logsign collects all the audit messages from the Windows environment however
many others collect only the basic ones.
Regardless of traditional solutions significantly handle small amounts of message
IDs, Logsign normalizes every message and classifies up to 400 message IDs.
This capacity keeps growing every time Logsign familiarizes with unknown new
messages which reduces the complexity of Windows events.

Advantages of Logsign
Logsign Windows Auditing helps in these areas:
● Real-time Control.
● User Behavior Analysis.
● File Integrity Monitoring.
● Archiving Data for Forensic Investigations and analysis.
● Compliance Reporting.
● Perfect Visualization within reports, alerts and dashboards.

For more details:
https://www.logsign.com/page/windows-auditing
http://support.logsign.net

Logsign Windows Auditing

More Related Content

What's hot

Viewers also liked

Similar to Logsign Windows Auditing

Recently uploaded

Logsign Windows Auditing