Welcome To CyberSafe Log Analyst

Welcome To
CyberSafe Log Analyst

CyberSafe Log Analyst (CLA) is a snap-in to the Microsoft Management Console (MMC). It is a Windows 2000 Security Event Log analysis tool that uses predefined analysis techniques. The CyberSafe Log Analyst assists you in organizing and interpreting security event logs from Windows 2000, providing more effective, system-wide user activity analysis.

  • Use CyberSafe Log Analyst to perform on-demand, efficient analysis of selected event log files. CLA processes a set of specified security event log files based on predefined activity signatures. Activity signatures are events, or a sequence of events, which can indicate compromised security. For example, there are activity signatures that can identify virus attacks or unauthorized administrative actions.

  • Once event log files have been analyzed, you can generate reports to simplify your security analysis. Reports are generated using predefined report templates included with CLA, or report templates that you define. You can configure these reports to view activity within a given time period by user, computer, or activity signature.

Related Topics

Applying effective audit policy
Getting started
Saving event log data
Adding event logs
Analyzing event logs
Generating reports


Legal Notice

COPYRIGHT NOTICE

This software product and accompanying documentation are copyrighted and all rights reserved by CyberSafe Corporation. Please refer to the accompanying CyberSafe Log Analyst License Agreement for a specification of the terms and conditions governing this product.

DISCLAIMER OF WARRANTY

WARRANTY LIMITATIONS - THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, CYBERSAFE DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IF THIS DISCLAIMER IS NOT ALLOWED, CYBERSAFE'S LIABILITY SHALL BE LIMITED TO REFUND OF THE PURCHASE PRICE. END USER AGREES THAT THE PRODUCT IS NOT CONSUMER GOODS FOR PURPOSES OF FEDERAL, OR STATE WARRANTY LAWS.

LIMITATIONS OF LIABILITY - TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL CYBERSAFE BE LIABLE FOR ANY LOSS, INCLUDING LOSS OR INACCURACY OF DATA OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, LOST PROFITS, LOST SAVINGS, TIME, MONEY, GOODWILL OR OTHER INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES, ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE, EVEN IF CYBERSAFE HAD BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TRADEMARKS

CyberSafe and the CyberSafe logo are registered trademarks of CyberSafe Corporation. CyberSafe Log Analyst and Centrax are trademarks of CyberSafe Corporation. Microsoft and Windows are registered trademarks of Microsoft Corporation. All other product or company names mentioned are used for identification purposes only, and may be trademarks or service marks of their respective owners.

Copyright ©1999 CyberSafe Corporation. All rights reserved.
August, 1999

Any reproduction of this documentation without the prior written permission of CyberSafe Corporation is strictly prohibited. Direct your comments on this online help to:

User Education Department
CyberSafe Corporation
6363 Greenwich Drive, Suite 150
San Diego CA 92122

Email: usered@cybersafe.com
Internet: www.cybersafe.com


Applying Effective Audit Policy

CyberSafe Log Analyst analyzes the Windows 2000 event log files against activity signatures. Activity signatures are events, or a sequence of events, which can indicate computer misuse. CLA uses a set of predefined activity signatures that have been defined by CyberSafe's security experts.

To effectively use CyberSafe Log Analyst, you should also apply effective audit policy. Applying effective audit policy reduces the number of events stored in the Windows 2000 event log file, and therefore reduces the number of insignificant activities that will be reported. Although you can specify the activity signatures in which you are interested when you generate a report, you should also apply modifiers to your audit policies. For example, the General Object Browsing activity signature detects the reading or attempted reading of any audited object on the system. If you specify Read access of files, a large number of events could be generated as all files are opened with Read access as a minimum. We recommend that you use the Success or Failure options as modifiers to reduce the number of events generated. The General Virus and Trojan Horse activity signature detects the modification or attempted modification (Write) of any audited executable (files that end with *.exe, *.bat, and *.com). Again, using Success or Failure options as modifiers of the Write access can reduce the number of events generated.

What are audit policies?

Audit policies are created so that you can monitor various system and user activities. They define which user and system activities are stored in the Windows 2000 security event log. The security event log, in turn, is used to detect intrusions and misuse of your computer systems. Audit policies consist of system, file/directory, and registry key audit parameters.

You track selected user activities and behavior by auditing security events and storing the data in the security event log. Your audit policy specifies the types of security events to be logged. The types of security events you include in an audit policy can range from system-wide events (such as a user logging on) to specific events (such as a user attempting to read a particular file). For each event, you can choose to include successful events, unsuccessful events, or both.

What is intrusion detection?

Intrusion detection is the process of reviewing activity records and indicators to identify misuse of your corporate network. The NT Security Log is a collection of security-related activity records that may be used to detect intrusion into and misuse of NT systems. When auditing is turned on, NT automatically collects relevant security events. Knowing what to set in a policy, and exporting that policy to all necessary computers, can be a tricky and time-consuming process. A properly defined policy can provide intrusion detection and unauthorized user access of network files and resources.

How do I apply audit policies?

Windows 2000 includes tools to help you configure auditing. File (NTFS) auditing is set from the Security tab on the Properties window of any file or directory (available by right-clicking the file or directory in Windows Explorer). You can also use third-party tools, such as the Centrax Audit Strategy Tools® (CAST®), which can automate the creation and deployment of audit policies across your entire enterprise. For more information CAST, visit the CyberSafe Web site at www.cybersafe.com.


Getting Started

The CyberSafe Log Analyst assists you in organizing and interpreting security event logs from Windows 2000, providing more effective, system-wide user activity analysis. There are three steps to analyzing user activity: saving event logs, analyzing event logs, and generating reports. This topic describes these steps in detail so you can begin to analyze activities immediately.

To save the local event log

This procedure automates the process of saving the event log from the computer where CLA is installed.

In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Cut Live Local Event Log from the shortcut menu. The event log is saved in the Pending subdirectory of CLA (for example, c:\program files\cla\pending). It is also added to the Logs to be Analyzed node, so you can immediately analyze the event log.

To save the event log from other computers

This procedure saves the current "raw" event logs from other computers. These instructions detail a very simple, manual method of saving the event log so you can later analyze it.

  1. On the computer where you installed CLA, "share" the Pending subdirectory (for example, \cla\pending). When you save the event logs from other computers, you will save them into this shared directory, so the event log files will automatically be added to CLA.

  2. On the computer containing the event log you want to analyze, open the Windows 2000 Event Viewer (by choosing Start > Administrative Tools (Common) > Event Viewer).

  3. Choose Log > Security to view the current day's security event log.

  4. Choose Log > Save As to save the event log. Note the file name must include the .evt file extension, and must be saved in the Pending subdirectory that you shared in Step 1.

To analyze event logs

In the CyberSafe Log Analyst scope pane, right-click the Logs to be Analyzed node and choose Analyze from the shortcut menu. The status of the analysis is displayed in the Description Bar (displayed above the results pane).

Note

If you have saved event logs directly into the Pending subdirectory of the CLA directory (for example, \cla\pending), they may not immediately appear in the Logs to be Analyzed node. To display these event logs, refresh the display by right-clicking the Logs to be Analyzed node and choosing Refresh from the shortcut menu.

To generate a report using a predefined template

  1. In the CyberSafe Log Analyst scope pane, select the Report Templates node.

  2. In the results pane, right-click the report template you want to use and choose Generate Report from the shortcut menu that appears. The Report Generator dialog box appears.

  3. Under Time Granularity, move the bar to select the granularity of the report. Choose Minute, Hour, 2 Hours, Day, Week, Month, or All Data. The default setting is for All Data.

  4. Under Examine Period, click the arrow and select the time period for this report. Choose to generate the report based on the Past 24 Hours, Past 7 Days, Past 30 Days, Yesterday, Last Week, Last Month, Custom Date Range, or Full Time Range. The default setting is for Full Time Range.

  5. Do the following:

  • To preview the report in a separate window, click Preview.

  • To output the report directly to your default printer, click Print. Use the standard Print dialog box to specify the print options.

  • To change the settings on your printer, click Print Setup. Use the standard Print Setup dialog box to specify the printer options (such as paper size and orientation).

  • To modify the report template options, click Formatting. The Report Generation dialog box expands so you can modify the date period, granularity, title, graph type and size, and table size of the report.

  6. When finished, click Close to exit the Report Generator dialog box.

Related topic

Applying effective audit policy


Getting Help

CyberSafe Log Analyst is designed for ease of use. If you have questions on how the program works, please refer to this online help file (look up a word in the index). You can also view a list of Frequently Asked Questions on our Web site. We recognize, however, that you may encounter occasional difficulties not described elsewhere in the manual or online help. CyberSafe Technical Support can be reached electronic mail via the Internet at Support@cybersafe.com.

Other sources

For additional information regarding Windows security auditing, you should refer to the documentation provided by Microsoft for the Windows 2000 system. Another source of information is the Microsoft Resource Kit.


Activity Signatures

Activity signatures are events, or a sequence of events, which can indicate computer misuse. CyberSafe Log Analyst analyzes event log files against a set of predefined activity signatures (these activity signatures have been defined by CyberSafe's security experts). To assist you, the description for each activity signature includes three recommendations for corrective action. The activity signatures are grouped into the following general categories:

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


Audit Administrative Activity Signatures

Audit Data Lost
Audit Log Cleared
Audit Policy Changed

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
NT System


Failed Single Logons Activity Signatures

Failed Logon: Unknown user name or bad password
Failed Logon: Account logon time restriction violation
Failed Logon: Account currently disabled
Failed Logon: Account Has Expired
Failed Logon: User not allowed to logon at this computer
Failed Logon: User has not been granted requested logon type at this machine
Failed Logon: Password has expired
Failed Logon: Netlogon component not active
Failed Logon: An unexpected error occurred during logon
Failed Logon: Account locked out

Other activity signatures

General
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


General Activity Signatures

General Virus and Trojan Horse Activity
General Object Browsing Activity
Back Orifice 2000

Other activity signatures

Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


Global Group Administrative Activity Signatures

Global Group Created
Global Group Member Added
Global Group Member Removed
Global Group Deleted
Global Group Changed

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Local Group Administrative
Audit Administrative
NT System


Local Group Administrative Activity Signatures

Local Group Created
Local Group Member Added
Local Group Member Removed
Local Group Deleted
Local Group Changed

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Audit Administrative
NT System


NT System Activity Signatures

NT Starting
Authentication Package Added
Notification Package Added by the Security Account Manager
Trusted Domain Added
Trusted Domain Removed
Domain Policy Changed

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative


Password Activity Signatures

Password Change Failed
Password Change Succeeded

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
User Administrative
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


Successful Logons/Logoffs Activity Signatures

Successful Logon (All Logon Types)

Other activity signatures

General
Failed Single Logons
User Administrative
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


User Administrative Activity Signatures

User Account Created
User Account Changed
User Account Enabled
User Account Disabled
User Account Deleted
User Right Assigned
User Right Removed

Other activity signatures

General
Failed Single Logons
Successful Logons/Logoffs
Password Activity
Global Group Administrative
Local Group Administrative
Audit Administrative
NT System


Editing activity signatures

For better reporting within your enterprise, you can edit the activity signatures. This is similar to applying a filter: you can specify the Username, User Domain, Computer, and other relevant information that you want to detect.

To edit an activity signature:

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Signature Editor from the shortcut menu.

  2. In the Signature Fields dialog box, click the arrow to select the signature you want to edit. A brief description of the activity signature appears in the field below the name.

  3. Under the Field Name column, select the field you want to edit and click Edit Filter. The Edit Filter dialog box appears.

  4. In the Edit Filter dialog box, check the box to Apply a Filter to this Field.

  5. In the Value field, enter the filter value(s). Separate multiple values with a comma. You can enter up to 1,024 characters in each field. Each field is case-sensitive. For example, if you use all lower-case letters in your domain names, enter all lower-case letters.

  6. If available, select the button to indicate you want to report events that contain All, Partial, or None of the value(s) you entered in the previous step.

  7. Click OK to exit the Edit Filter dialog box.

  8. In the Signature Fields dialog box, do one of the following:

  • To edit another signature, click the arrow to display the list of activity signatures.

  • To exit the Signature Fields dialog box (and save all of your edits), click OK.


Specifying log settings

Use the Properties dialog boxes of the Logs to be Analyzed and Analyzed Logs nodes to specify where you want to store the event logs.

To specify the location of logs to be analyzed

  1. In the CyberSafe Log Analyst scope pane, right-click the Logs to be Analyzed node and choose Properties from the shortcut menu. The Logs to be Analyzed Properties Dialog Box appears.

  2. Under Save Log Files In, select the location where you want to store event log files to be analyzed. To change the location of the pending event log files, click Browse to display the Browse for Folder dialog box. When you have specified more than one directory for the pending event log files, you can click the arrow to change from one location to another.

Note

When you change folders, all of the logs to be analyzed are moved from the current folder to the new folder.

To specify the location of logs that have been analyzed

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Properties from the shortcut menu. The Analyzed Logs Properties Dialog Box appears.

  2. Under Save Log Files In, select the location where you want to store event logs files that have been analyzed. To change the location of the analyzed event log files, click Browse to display the Browse for Folder dialog box. When you have specified more than one directory for the analyzed event log files, you can click the arrow to change from one location to another.

Note

When you change folders, all of the logs to be analyzed are moved from the current folder to the new folder.

Related topic

Specifying event database settings


Specifying event database settings

Use the CyberSafe Log Analyst Properties dialog box to specify where you want to store the CLA event database. The event database stores analyzed events and detected activity signatures. The event database is used when you generate reports.

To specify the location of the event database

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Properties from the shortcut menu. The CyberSafe Log Analyst Properties Dialog Box appears.

  2. Under Store Event Database In, select the location of the database. To change the location of the database, click Browse to display the Browse for Folder dialog box. When you have specified more than one location for the database, you can click the arrow to select another location.

Related topic

Specifying log settings
Compressing the event database
Deleting events from the event database


Working With the Event Database

As CyberSafe Log Analyst analyzes event logs, events matching the predefined activity signatures are stored in the event database. The event database is used when you generate reports. Because all events matching the activity signatures are stored, and you may not want to generate reports on all of these events, you can specify the events you want to view when you define your report templates or when you generate reports.

Related topics

Specifying event database settings
Compressing the event database
Deleting events from the event database


CyberSafe Log Analyst Properties Dialog Box

This dialog box appears when you select the CyberSafe Event Log Analysis node in the scope (left) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to specify where you want to store the event database. The event database stores events and detected activity signatures. This dialog box also displays statistics on the files database.

Store Event Database In Select the location of the database. To change the location of the database, click Browse to display the Browse for Folder dialog box. When you have specified more than location for the database, you can click the arrow to select another location.

Database Size Displays the total size of the event database.

First Event Displays the date of the first event stored in the event database.

Last Event Displays the date of the last event stored in the event database.

Duration Displays the total length of time between the first and last events.

No of Events Displays the total number of events found in the event database.

No of Users Displays the total number of users in the events stored in the event database.

No of Computers Displays the total number of computers in the events stored in the event database.

Database Size Displays the size of the event database, in kilobytes.

Related topic

Specifying event database settings


Logs to be Analyzed Properties Dialog Box

This dialog box appears when you select the Logs to be Analyzed node in the scope (left) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to specify where you want to save log files that are to be analyzed. This dialog box also displays statistics on the files and events stored in this folder.

Save Log Files In Displays the current folder where event logs files to be analyzed are stored. To change the location of the pending event log files, click Browse to display the Browse for Folder dialog box. When you have specified more than one directory for the pending event log files, you can click the arrow to change from one location to another.

Note

When you change folders, all of the logs to be analyzed are moved from the current folder to the new folder.

Total Size Displays the total size of all event log files stored in the folder.

Contains Displays the total number of event log files stored in the folder.

First Event Displays the date and time of the first event log file stored in the folder.

Last Event Displays the date and time of the last event log file stored in the folder.

Duration Displays the total length of time between the first and last events.

No of Events Displays the total number of events found in all event logs files stored in the folder.

No of Users Displays the total number of users included in the event logs.

No of Computers Displays the total number of computers included in the event logs.

Related topics

Analyzing event logs
Specifying log settings


Edit Filter Dialog Box

This dialog box appears when you click Edit Filter in the Signature Fields dialog box. Use the Edit Filter dialog box to specify filter parameters for an activity signature field.

Signature Displays the name of the signature you are editing.

Field Displays the name of the field you are editing.

Apply a Filter to this Field Check this box to define the filter value for this field. The value field becomes available.

Value Enter the filter value. (Click here for more information.)

    Object Name Enter the name of the object you want to detect. You can use wildcards to indicate any file or directory. (For example, to detect access to any .exe file, enter *:\\*.exe in this field.) This is available for General Object Browsing and General Virus/Trojan Horse activities.

    User Name Enter the name of the user (for example, heim). You can enter up to 1,024 characters and this field is case-sensitive. To enter multiple values, separate each value with a comma (for example, heim,masters).

    User Domain Enter the name of the user's domain (for example, development). You can enter up to 1,024 characters and this field is case-sensitive. To enter multiple values, separate each value with a comma (for example, development,business).

    Computer Enter the name of the computer (for example, leghorn). You can enter up to 1,024 characters and this field is case-sensitive. To enter multiple values, separate each value with a comma (for example, leghorn,roadrunner).

    Account Name Enter the name of the account. This is available for User Accounts, Global Group, and some Password activities. You can enter up to 1,024 characters and this field is case-sensitive. To enter multiple values, separate each value with a comma (for example, heim,masters).

    Account Domain Enter the name of the account's domain. This is available for User Accounts, Global Group, and some Password activities. You can enter up to 1,024 characters and this field is case-sensitive. To enter multiple values, separate each value with a comma (for example, development,business).

Related topic

Editing activity signatures


Signature Fields Dialog Box

This dialog box appears when you select the CyberSafe Log Analyst node in the scope (left) pane, right-click the mouse, and choose Signature Field Editor from the shortcut menu. Use this dialog box to modify the activity signatures used to detect events.

Select a Signature to Edit Click the arrow to select the activity Signature you want to edit from the list displayed. A brief description of the activity signature appears below this field.

Select a Field for Filtering To edit a field, select the Field Name and then click Edit Filter. The fields and filters displayed are specific to the signature you are editing. The current filter information is displayed in the Filter column.

Edit Filter Click this button to display the Edit Filter dialog box so you can edit the selected Field Name.


Compressing the event database

You may want to compress your database, in order to reduce the amount of unused space (resulting in a smaller database size).

To compact your database

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Utilities from the shortcut menu.

  2. In the Database Utilities dialog box, click Compress. A message appears when the event database is compressed.

Related topics

Specifying event database settings
Deleting events from the event database


Deleting events from the event database

You may find that you want to delete all or some events from the event database. Delete all events so you can reanalyze those events that you have already analyzed, or so that you can start again with a "clean" database. Delete a range of events for a time period for which you no longer want to generate reports.

To delete all events

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Utilities from the shortcut menu.

  2. In the Database Utilities dialog box, click Purge.

  3. After the database has been purged, a dialog box appears asking if you want to copy the logs back to the Pending folder so that you can reanalyze them. To reanalyze the event logs, click Yes.

To delete a range of events

  1. In the CyberSafe Log Analyst scope pane, right-click the CyberSafe Log Analyst node and choose Utilities from the shortcut menu. The Database Utilities dialog box appears.

  2. In the From field, enter the date and time of the first event you want to delete from the database. To display a calendar from which to select the date, click the arrow in the Date field.

  3. In the To field, enter the date and time of the last event you want to delete from the database. To display a calendar from which to select the date, click the arrow in the Date field.

  4. Click Delete Range. A message appears when the events have been deleted.

Related topics

Specifying event database settings
Compressing the event database


Database Utilities Dialog Box

This dialog box appears when you select the CyberSafe Log Analyst node in the scope (left) pane, right-click the mouse, and choose Utilities from the shortcut menu. Use this dialog box to compress your event database and to delete records from the database.

Compress Click this button to compress the event database in order to reduce the amount of unused space (resulting in a smaller database size).

Purge Click this button to purge all events from the event database. After the database has been purged, a dialog box appears asking if you want to copy the logs back to the Pending folder so that you can reanalyze them.

Delete Range Click this button to delete the events in the event database for the time range specified. Use the calendar controls to specify the first and last events you want to delete.

Related topics

Compressing the event database
Deleting events from the event database


Working With Event Logs

Use CyberSafe Log Analyst to perform on-demand, efficient analysis of selected event log files. CLA processes a set of specified security event log files based on predefined activity signatures. Activity signatures are events, or a sequence of events, which can indicate compromised security. For example, there are activity signatures that can identify virus attacks or unauthorized administrative actions.

In order to analyze event logs, you must make them available to CyberSafe Log Analyst. This is a two-step process: first you save the "raw" event log, then you add the saved event log to the Logs to be Analyzed node.

Related topics

Saving event log data
Adding event logs
Analyzing event logs


Saving event log data

In order to analyze event logs, you must make them available to CyberSafe Log Analyst. This is a two-step process: first you save the "raw" event log, then you add the saved event log to the Logs to be Analyzed node in CLA.

The following two procedures describe how to save the "raw" event log data on the computer running CLA and on other computers. Note that you can use your own method of saving the event log. We recommend that you use a batch operation to save multiple event logs from multiple computers.

To save the local event log

This procedure automates the process of saving the event log from the computer where CLA is installed.

In the CyberSafe Log Analyst scope pane, right-click the Logs to be Analyzed node and choose Cut Live Local Event Log from the shortcut menu. The event log is saved in the Pending subdirectory of CLA (for example, c:\program files\cla\pending). It is also added to the Logs to be Analyzed node, so you can immediately analyze the event log.

To save the event log from other computers

This procedure saves the current "raw" event logs from other computers. These instructions detail a very simple, manual method of saving the event log so you can later analyze it.

  1. On the computer containing the event log you want to analyze, open the Windows 2000 Event Viewer (by choosing Start > Administrative Tools (Common) > Event Viewer).

  2. Choose Log > Security to view the current day's security event log.

  3. Choose Log > Save As to save the event log. Note the file name must include the .evt file extension, and must be saved in the Pending subdirectory of CLA (for example, c:\program files\cla\pending).

Related Topic

Adding event logs


Adding event logs

In order to analyze event logs, you must first save the "raw" event log data for each computer you want to analyze. If you saved the event logs directly into the Pending subdirectory of CLA (for example, \cla\pending), then those event logs are immediately available for analyzing and you do not need to perform the following steps. However, if you saved the event logs into another location (for example, a directory on a network drive), then you need to follow the steps below.

Note

If you have saved event logs directly into the Pending subdirectory of the CLA directory (for example, \cla\pending), they may not immediately appear in the Logs to be Analyzed node. To display these event logs, refresh the display by right-clicking the Logs to be Analyzed node and choosing Refresh from the shortcut menu.

To add event logs

  1. In the CyberSafe Log Analyst scope pane, right-click the Logs to be Analyzed node and choose Add Event Log File from the shortcut menu.

  2. In the Open dialog, locate the event log file and click open.

    TIP To select multiple contiguous files, use Shift as you select the files. To select multiple non-contiguous files, use Control as you select the files.

The event log files can now be analyzed by CyberSafe Log Analyst.

Related topic

Saving event log data
Analyzing event logs


Analyzing event logs

Once you have added event logs, you can analyze them. Event logs that have been analyzed are moved from the Logs to be Analyzed node to the Analyzed Logs node.

Note

Event logs that you have analyzed may not immediately appear in the Analyzed Logs node. To display these event logs, refresh the display by right-clicking the Analyzed Logs node and choosing Refresh from the shortcut menu.

To analyze event logs

In the CyberSafe Log Analyst scope pane, right-click the Logs to be Analyzed node and choose Analyze from the shortcut menu. The status of the analysis is displayed in the Description Bar (displayed above the results pane).

Related topics

Adding event logs
Generating reports


Viewing event logs

The CyberSafe Event Viewer allows you to view the event logs from both Windows NT and Sun Solaris computers. The CyberSafe Event Viewer is similar to the Event Viewer provided with Windows NT, with the following exceptions:

  • Provides a Multiple Document Interface (MDI) so you can view multiple event logs at a time.

  • Can be launched as a separate program from Start > Programs, or can be launched from within the program.

  • Opens event logs generated on both Windows NT and Solaris computers.

Note

Use the CyberSafe Event Viewer to view event logs that have been saved, such as those saved by Centrax in the \Archive subdirectory. You cannot use the CyberSafe Event Viewer to view current event logs.


Viewing Event Log File properties

You can view the properties of each event log (in either the Logs to be Analyzed or Analyzed Logs nodes). The properties of an event log includes the size of the log, the date created, the date and times of the first and last events in the log, the number of events and users, and the computer where the event log was created.

To view the properties of an event log

In the Logs to be Analyzed or Analyzed Logs results pane, right-click the event log file whose properties you want to view and choose Properties from the shortcut menu. The Event Log File Properties dialog box appears.

Related topic

Analyzing event logs


Event Log File Properties Dialog Box

This dialog box appears when you select an event log file in the results (right) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to specify view the statistics of the event log.

Location Displays the location where the event log file is stored on your computer.

Size Displays the size of the event log file.

Modified Displays the date and time the event log file was last modified.

First Event Displays the date and time of the first event in the event log file.

Last Event Displays the date and time of the last event in the event log file.

Duration Displays the total amount of time between the first and last events.

No of Events Displays the total number of events found in the event log file.

No of Users Displays the total number of users who generated events in the event log file.

Computer Displays the name of the computer where the event log file was generated.

Related topic

Viewing event logs


Working With Reports

Once event log files have been analyzed, you can generate reports to simplify your security analysis. Reports are generated based on report templates.

CyberSafe Log Analyst includes several predefined report templates. You can use these predefined reports, or you can create your own templates on which to generate reports. Configure these reports to view activities within a given time period by user, computer, or activity signature.

Related topics

Defining report templates
Generating reports


Defining report templates

Reports are generated based on report templates. CyberSafe Log Analyst includes several predefined report templates. You can use these predefined reports, or you can create your own template on which to generate the report.

Note

New report templates that you create may not immediately appear in the Report Templates node. To display these templates, refresh the display by right-clicking the Report Templates node and choosing Refresh from the shortcut menu.

To define a report template

  1. In the CyberSafe Log Analyst scope pane, right-click the Report Templates node and choose New > Report Template from the shortcut menu. The Report Template Designer dialog box appears.

  2. In the Template Name field, enter the name of the report. This is the name that is displayed in the results pane when the Report Templates node is active.

  3. In the Template Description field, enter a description of the report. This is the description that is displayed in the results pane when the Report Templates node is active.

  4. Under Report on Signatures, Targets, and Users, select the targets, users, and activity signatures on which you want to generate the report. Selecting a top-level box selects all elements below that level.

  5. In the Examine Period field, click the arrow and select the time period for the report. Choose to generate the report based on: Past 24 Hours, Past 7 Days, Past 30 Days, Yesterday, Last Week, Last Month, Custom Date Range, Full Time Range. When you generate a report based on this template, you have the option to change the date range in the Report Generator dialog box.

    TIP To specify the date range each time you generate a report, select Custom Date Range (you can specify the dates in the Report Generation dialog box). To generate reports on all dates in the event logs, select Full Time Range.

  6. In Time Granularity, move the bar to select the granularity of time in the report. Choose Minute, Hour, 2 Hours, Day, Week, Month, or All Data.

  7. In the Title field, enter the name of the report or other name that you want to appear on the printed report. If you do not want a title printed on your report, leave this field blank.

  8. In the Company Name field, the name of your company is automatically entered (this is the name that you entered when you registered CLA). If you do not want the name of your company printed on your report, leave this field blank.

  9. To print your company logo (or other graphic) on your report, check the box for Use Logo. Click Set Bitmap to display the Open dialog, browse for and select the bitmap you want to use.

  10. In the Graph Type field, click the arrow and select the type of graph you want to print. You can print a bar chart, a three-dimensional bar chart, or a pie chart at the top of your report. If you do not want to include a chart, select None.

  11. To limit the number of elements when you use a graph, check the box for Max Graph Size and enter the maximum number of elements you want to include in the graph.

  12. In Include Table Fields, do the following:

  • To indicate the information you want to include in the report, check the boxes next to the items. Choose to include Users, Targets, Signatures, or Object Attributes. You must choose at least one item. Selecting Object Attributes includes the file and/or directory names accessed, if applicable, in your report. Note that Count is always checked; it is included in the list so you can choose where you want it included in the sort order.

  • To reorder the list to indicate how you want to sort data in the report, select an item and "drag" it to a new location.

  13. To limit the number of lines in the table, check the box for Max Table Size and enter the maximum number of lines you want to include in the table.

Related topic

Generating reports
Modifying report templates


Modifying report templates

Reports are generated based on report templates. CyberSafe Log Analyst includes several predefined report templates. You can use these predefined reports as a basis for new report templates (by modifying them). You can also make modifications to any report templates you create.

Note

We recommend that you make a backup copy of the report templates before you modify any of these predefined templates. The report templates are stored in the Reports subdirectory of the CLA directory (for example, \cla\report).

To modify a report template you created

  1. In the CyberSafe Log Analyst results pane, right-click the report template you want to modify and choose Properties from the shortcut menu. The Template Properties dialog box appears.

  2. Click Set Properties. After a moment, the Report Templates Properties dialog box appears.

  3. Make the changes to the report template.

  4. Click Save to save your changes.

Related topic

Generating reports


Viewing Report Template properties

Reports are generated based on report templates. CyberSafe Log Analyst includes several predefined reports.

To view the properties of a report template

In the CyberSafe Log Analyst results pane, right-click the report template you want to modify and choose Properties from the shortcut menu. The Template Properties dialog box appears.

To view or modify the report template, click Set Properties. The Report Template Designer dialog box appears.

Related topic

Modifying report templates


Generating reports

Once you have analyzed event log files, you can generate reports.

Note

You must first define the report template on which to generate the report.

To generate a report:

  1. In the CyberSafe Log Analyst scope pane, select the Report Templates node.

  2. In the results pane, right-click the report template you want to use and choose Generate Report from the shortcut menu that appears. The Report Generator dialog box appears.

  3. Under Time Granularity, move the bar to select the granularity of the report. Choose Minute, Hour, 2 Hours, Day, Week, Month, or All Data. The default setting is for All Data.

  4. Under Examine Period, click the arrow and select the time period for this report. Choose to generate the report based on the Past 24 Hours, Past 7 Days, Past 30 Days, Yesterday, Last Week, Last Month, Custom Date Range, or Full Time Range. The default setting is for Full Time Range.

  5. Do the following:

  • To preview the report in a separate window, click Preview.

  • To output the report directly to your default printer, click Print. Use the standard Print dialog box to specify the print options.

  • To change the settings on your printer, click Print Setup. Use the standard Print Setup dialog box to specify the printer options (such as paper size and orientation).

  • To modify the report template options, click Formatting. The Report Generation dialog box expands so you can modify the date period, granularity, title, graph type and size, and table size of the report.

  6. When finished, click Close to exit the Report Generator dialog box.

Related topics

Defining report templates


Template Properties Dialog Box

This dialog box appears when you select a report template in the results (right) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to change the options in the report template.

Description Displays the description of the report. The description can be changed with you modify the report template by clicking Set Properties.

Set Properties Click this button to display the Report Template Designer dialog box so you can modify the report template.

Related topic

Modifying report templates


Report Template Designer Dialog Box

This dialog box appears when you choose New > Report Template (from the shortcut menu displayed when you right-click the Report Templates node in the scope pane) or when you click Set Criteria in the Report Template Properties dialog box. Use this dialog box to create or modify a template you can use to generate reports.

Template Name To create a new report template, enter a name. You can enter up to 120 characters in this field. To open a saved template, click Open. To save the report template, click Save.

Template Description Enter a description of the report template. You can enter up to 120 characters in this field. This description is displayed in the results pane.

Report on Signatures, Targets, and Users Select the targets, users, and/or signatures you want included in this report. To select multiple names, use Shift while selecting the first and last names.

Examine Period Click the arrow and select the time period for the report. Choose to generate the report based on: Past 24 Hours, Past 7 Days, Past 30 Days, Yesterday, Last Week, Last Month, Custom Date Range, Full Time Range. The default setting is for Full Time Range.

Time Granularity Move the bar to select the granularity of time in the report. Choose Minute, Hour, 2 Hours, Day, Week, Month, or All Data. The default setting is for All Data.

Formatting Use this section to define the default formatting you want to use when you generate reports. You can override the default formatting any time you generate a report by clicking Formatting in the Report Generation dialog box. (Click here for more information.)

    Title Enter the default title as you want it to appear on the generated report. The default title is "Report Title." You can enter up to 120 characters in this field.

    Company Name Enter your company name as you want it to appear on the generated report. The default name is the company name you entered when you entered registration information for CLA. You can enter up to 120 characters in this field.

    Use Logo Check this box if you want to use a bitmapped image of your logo on the report. Click Set Bitmap to specify the bitmapped image you want to use. The default setting is unchecked.

    Graph Type Select the type of chart. Choose Bar Chart, Pie Chart, or 3D Chart. The default setting is Bar Chart.

    Max Graph Size Check this box to limit the number of elements printed in the graphical portion of the report. Enter the maximum number of elements you want to include. The default setting is unchecked.

    Include Table Fields Check the boxes to indicate the information you want to include in the report. Choose Users, Targets, Signatures, or Object Attributes. Selecting object attributes includes the files and/or directories that were accessed, if applicable, in your report. You can reorder the list to indicate how you want the data sorted. To reorder your choices, select a choice and "drag" it to the new location. Note that Count is always checked; it is included in the list so you can choose where you want it included in the sort order.

    Max Table Size Check this box to limit the number of lines listed in the textual portion of the report. Enter the maximum number of lines you want to list. The default setting is unchecked.

Related topic

Generating reports


Report Generator Dialog Box

This dialog box appears when you click Generate. Use this dialog box to generate a report based on a template you have defined.

Select a Report Template to Open Select the template on which you want the report based. This list displays the predefined templates included with CLA and all those you have defined.

Description Displays the description of the report template you selected.

Time Granularity Move the bar to select the granularity of time in the report. Choose Minute, Hour, 2 Hours, Day, Week, Month, or All Data. The default setting is for All Data.

Examine Period Click the arrow and select the time period for the report. Choose to generate the report based on: Past 24 Hours, Past 7 Days, Past 30 Days, Yesterday, Last Week, Last Month, Custom Date Range, Full Time Range. The default setting is for Full Time Range.

Preview Click this button to view the report before you print it.

Print Click this button to generate the report based on the template you selected. Use the standard Print dialog to specify the options, such as the number of copies you want to print.

Print Setup Click this button to change the settings on your printer. Use the standard Print Setup dialog box to specify the printer options (such as paper size and orientation)

Formatting Click this button to expand the dialog box so you can modify the Output Formatting. The Output Formatting is defined in the report template, but you can change it each time you generate a report. Format options include Title, Company Name, Graph Type an Size, and Fields Displayed. (Click here for more information.)

    Title Enter the default title as you want it to appear on the generated report. The default title is "Report Title." You can enter up to 120 characters in this field.

    Company Name Enter your company name as it you want it to appear on the generated report. The default name is the company name you entered when you entered registration information for CLA. You can enter up to 120 characters in this field.

    Graph Type Select the type of chart. Choose Bar Chart, Pie Chart, or 3D Chart.

    Max Graph Size Check this box to limit the number of elements printed in the graphical portion of the report. Enter the maximum number of elements you want to include. The default setting is unchecked.

    Check Fields to be Displayed Check the boxes to indicate the information you want to include in the report. Choose Users, Targets, Signatures, or Object Attributes. Reorder the list to indicate how you want the data sorted. To reorder your choices, select a choice and "drag" it to the new location. Note that Count is always checked; it is included in the list so you can choose where you want it included in the sort order.

    Max Table Size Check this box to limit the number of lines listed in the textual portion of the report. Enter the maximum number of lines you want to list. The default setting is unchecked.

Related topics

Generating reports
Modifying report templates


Report Templates Properties Dialog Box

This dialog box appears when you select the Report Templates node in the scope (left) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to specify where you want to save report templates.

Save Report Templates In Displays the current folder where report template files are stored. To change the location of the report template files, click Browse to display the Browse for Folder dialog box. When you have specified more than one directory for the report template files, you can click the arrow to change from one location to another.

Related topics

Generating reports
Modifying report templates


Audit Data Lost

NT could not save all audit events into the security log.

Sequence: 516.

Security Relevance: Lost audit data should happen very infrequently. It may indicate a larger problem, namely that disk space is low on the event log volume. A user could launch a denial of service attack by consuming all disk space where the security event log is located.

Corrective Action: Determine if disk space is low and correct.

Related topic

Audit Log Cleared
Audit Policy Changed
Audit Policy Disabled


Audit Log Cleared

The NT security event log has been cleared.

Sequence: 517.

Security Relevance: Changes, outside of those made by a system administrator, may indicate audit trail tampering.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the account. Logoff the user. Correct the user’s system authority. Notify the user and user’s supervisor.

Concerned – Disable the account. Logoff the user. Correct the user’s system authority. Notify the user and user’s supervisor.

Cautious – Correct the user’s system authority. Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: Restart, Shutdown, and System (Success and Failure)

Related topic

Audit Data Lost
Audit Policy Changed
Audit Policy Disabled


Audit Policy Changed

The system level audit policy has been modified.

Sequence: 612.

Security Relevance: Changes, outside of those made by a system administrator, may indicate audit trail tampering.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the account. Logoff the user. Correct the user’s system authority. Notify the user and user’s supervisor.

Concerned – Disable the account. Logoff the user. Correct the user’s system authority. Notify the user and user’s supervisor.

Cautious – Correct the user’s system authority. Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topic

Audit Data Lost
Audit Log Cleared
Audit Policy Disabled


Authentication Package Added

A new authentication package was added to the system.

Sequence: 514.

Security Relevance: This is a highly unusual event (except at system startup) and may indicate that someone is attempting to replace the system level security code with different, possibly inferior or Trojan Horse laden, code.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Shutdown the target immediately and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Concerned – At a convenient time, shutdown the target and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Cautious – At a convenient time, shutdown the target and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Audit Policy Settings Required

System Flags: Restart, Shutdown, and System (Success and Failure)

Related topics

NT Starting
Notification Package Added by the Security Account Manager
Trusted Domain Added
Trusted Domain Removed
Domain Policy Changed


Back Orifice 2000

The accessing of a set of files (DLLs) in a specific order may indicate the presence of the Back Orifice 2000 program, and has been designated as a security risk by the security officer.

Sequence: 560 (both success and failure).
Object is defined as critical to the execution of Back Orifice 2000.

Security Relevance: Adding or modifying the "Cult of the dead cow" executables may introduce Trojan Horse programs into the system. This behavior can potentially lead to system downtime, data corruption, copyright infringements and even loss or theft of proprietary and intellectual property.

Corrective Action:

Critical – Disable user’s account. Notify user’s supervisor. Restore modified files from backup media. Scan for viruses.

Concerned – Disable user’s account. Notify user’s supervisor. Scan for viruses.

Cautious – Notify user’s supervisor. Generate a report to see if this is a repetitive behavior. Scan for viruses.

Audit Policy Settings Required

System Flags:

Traverse Folder/Execute File (Success and Failure)
on files: avicap.dll, mmdrv.dll, msvfw32.dll, netapi.dll, winmm.dll

Related topic

General Virus and Trojan Horse Activity
General Object Browsing Activity


Domain Policy Changed

The domain’s security policy was modified or modification was attempted.

Sequence: 643.

Security Relevance: Domain policies should remain fairly constant. Unannounced changes to domain policies should be analyzed immediately. This may indicate a denial of service attack.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Shutdown the domain’s PDC and take the PDC off-line for analysis. Notify the user and user’s supervisor. Notify the user community.

Concerned – Analyze the domain’s PDC and, if necessary, take off-line. Notify the user and user’s supervisor. Notify the user community.

Cautious – Analyze the domain’s PDC. Notify the user and user’s supervisor. Notify the user community.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topics

NT Starting
Authentication Package Added
Notification Package Added by the Security Account Manager
Trusted Domain Added
Trusted Domain Removed


Failed Logon: Account Currently Disabled

Indicates a user may be attempting to logon to a restricted account or the account was locked automatically due to a previous attack. The user knows the account’s password.

Sequence: 531.

Security Relevance: Logon failed because the account is currently disabled.

Corrective Action:

Critical – Determine the origin (e.g., console, remote) of attempts. Notify the user (if still exists) and the user’s supervisor.

Concerned – Determine the origin (e.g., console, remote) of attempts. Notify the user (if still exists) and the user’s supervisor.

Cautious – Make a note for future reference.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: Account Has Expired

Logon failed because the account has expired.

Sequence: 532.

Security Relevance: Indicates a user may be testing an old account for accessibility. The user knows the account’s password.

Corrective Action:

Critical – Disable user’s account. Determine the origin (e.g., console, remote) of attempts. Notify the user’s supervisor.

Concerned – Determine the origin (e.g., console, remote) of attempts. Notify the user’s supervisor.

Cautious – Make a note for future reference.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: Account Locked Out

Logon failed because the account is currently locked out.

Sequence: 539.

Security Relevance: The account may have been locked out due to previous logon attacks. The attacking user may still be attempting to gain access or the account owner may be attempting to logon.

Corrective Action:

Critical – Disable user’s account. (Account locking under this condition can create a denial of service mechanism.) Notify the user and the user’s supervisor.

Concerned – Determine origin (e.g., console, remote) of attempts. Notify the user and the user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon


Failed Logon: Account Logon Time Restriction Violation

Logon failed due to account logon time restrictions.

Sequence: 530

Security Relevance: Indicates a user may be attempting to find an account that does not currently have a time restriction. Possibly the user isn’t aware of the current time. The user knows the account’s password.

Corrective Action:

Critical – Disable user’s account. (Account locking under this condition can create a denial of service mechanism.) Notify the user and the user’s supervisor.

Concerned – Determine the origin (e.g., console, remote) of attempts. Notify the user and the user’s supervisor.

Cautious – Notify the user and the user’s supervisor.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: An Unexpected Error Occurred During Logon

Logon failed for an undetermined reason.

Sequence: 537.

Security Relevance: Indicates a potential problem with the logon mechanism and a denial of service. It should NOT be construed as the user’s fault.

Corrective Action: Possible denial of service attack. Immediate corrective action is necessary if problem persists.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: Account Locked Out


Failed Logon: Netlogon Component Not Active

Logon failed because Netlogon is not active.

Sequence: 536.

Security Relevance: Indicates a potential problem with Netlogon. The user is probably NOT at fault. This could be a denial of service attack if a non-administrative user disabled Netlogon.

Corrective Action: Reactivate Netlogon as soon as possible if Netlogon should be active.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: Password Has Expired

Logon failed because the account’s password has expired.

Sequence: 535.

Security Relevance: May indicate a user attempting to guess an account name or an account’s password. Multiple occurrences on a particular account at sporadic times may indicate account sharing among users where one or more users were not aware that the password expired. May indicate that the user was away from the system when the password expired.

Corrective Action:

Critical – Disable user’s account. (Account locking under this condition can create a denial of service mechanism.) Notify the user and the user’s supervisor.

Concerned – Determine origin (e.g., console, remote) of attempts. Notify the user and the user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: Unknown User Name or Bad Password

Logon failed due to an unknown user name or bad password.

Sequence: 529

Security Relevance: Indicates a user may have mistyped the password or be attempting to guess an account name or an account’s password. May indicate that the Cap Locks key was active or that the user doesn’t understand that passwords are case sensitive.

Corrective Action:

Critical – Disable user’s account. (Account locking under this condition can create a denial of service mechanism.) Notify the user and the user’s supervisor.

Concerned – Notify system administrator and determine origin (e.g., console, remote) of attempts. Notify the user and the user’s supervisor.

Cautious – Notify the user and the user’s supervisor.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine

Logon failed because the user attempted to logon via a logon method (e.g., interactive, network (drive map), batch, service, etc.) currently not allowed.

Sequence: 534.

Security Relevance: Indicates a user may be attempting to access a computer via a restricted method. It may indicate a user looking for a vulnerability in the current enterprise configuration. Since a target’s valid logon types are not generally available, it could be that the user wasn’t aware of the restriction.

Corrective Action:

Critical – Disable user’s account. (Account locking under this condition can create a denial of service mechanism.) Notify the user and the user’s supervisor.

Concerned – Determine the origin (e.g., console, remote) of attempts. Notify the user and the user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Not Allowed to Logon at This Computer
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


Failed Logon: User Not Allowed to Logon at This Computer

Logon failed because the computer has restricted access.

Sequence: 533.

Security Relevance: Indicates a user may be attempting to gain access to a restricted computer. The user knows the account’s password. The user may not realize the computer is restricted or may be looking for a vulnerability in the current enterprise configuration.

Corrective Action:

Critical – Notify the user and the user’s supervisor.

Concerned – Notify the user and the user’s supervisor.

Cautious – Notify the user. Make a note for future reference.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)

Related topics

Failed Logon: Unknown User Name or Bad Password
Failed Logon: Account Logon Time Restriction Violation
Failed Logon: Account Currently Disabled
Failed Logon: Account Has Expired
Failed Logon: User Has Not Been Granted Requested Logon Type at This Machine
Failed Logon: Password Has Expired
Failed Logon: Netlogon Component Not Active
Failed Logon: An Unexpected Error Occurred During Logon
Failed Logon: Account Locked Out


General Object Browsing Activity

Detects the reading or attempted reading of any audited object on the system.

Sequence: 560 or 563 (both success and failure).
Object is defined as any audited object on the system.

Security Relevance: Reading these objects indicates a browsing user. Browsing behavior may indicate a user who is searching for a potential security vulnerability in the operating system or proprietary information. This behavior can potentially lead to system downtime and loss of proprietary or intellectual property.

Corrective Action:

Critical – Disable user’s account and notify user’s supervisor.

Concerned – Notify user’s supervisor.

Cautious – Make a note of this for future reference. Generate a report to see if this is a repetitive behavior.

Audit Policy Settings Required

System Flags: File and Object Access (Success and Failure)

Related topic

General Virus and Trojan Horse Activity


General Virus and Trojan Horse Activity

Detects the modification or attempted modification of any audited executable (files that end with *.exe, *.bat, and *.com).

Sequence: 560 or 563 (both success and failure).
Object is defined as any audited executable. For 560 Accesses contains WriteData, AppendData, or DELETE. 563 automatically triggers this signature.

Security Relevance: The modification of executables may indicate the introduction of viruses and Trojan Horse programs into the system. This behavior can potentially lead to system downtime, data corruption, copyright infringements and even loss or theft of proprietary and intellectual property.

Corrective Action:

Critical – Disable user’s account. Notify user’s supervisor. Restore modified files from backup media. Scan for viruses.

Concerned – Disable user’s account. Notify user’s supervisor. Scan for viruses.

Cautious – Notify user’s supervisor. Generate a report to see if this is a repetitive behavior. Scan for viruses.

Audit Policy Settings Required

System Flags: File and Object Access (Success and Failure)

Related topic

General Object Browsing Activity


Global Group Changed

A global group was modified or a modification was attempted.

Sequence: 641.

Security Relevance: Modifying a global group requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable user’s account. Correct the modified group. Notify the user and user’s supervisor.

Concerned – Correct the modified group. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Global Group Administrative Activity
Global Group Created
Global Group Member Added
Global Group Member Removed
Global Group Deleted


Global Group Created

A new global group was created or creation was attempted.

Sequence: 631.

Security Relevance: Creating a new global group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is creating a new global group to obscure future activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the new group (i.e., remove user rights, etc.). Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Disable the new group. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Global Group Administrative Activity
Global Group Member Added
Global Group Member Removed
Global Group Deleted
Global Group Changed


Global Group Deleted

A global group was deleted or a deletion was attempted.

Sequence: 634.

Security Relevance: Deleting a global group requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Once a group is deleted, the group’s SID can not be reused.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Create a new group to replace the deleted one. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Create a new group. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Global Group Administrative Activity
Global Group Created
Global Group Member Added
Global Group Member Removed
Global Group Changed


Global Group Member Added

A user was added to a global group or an addition was attempted.

Sequence: 632.

Security Relevance: Adding a user to a global group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is obtaining other authorities for himself or others.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the modified account and correct group membership. Disable user’s account. Logoff user. Notify the user and user’s supervisor.

Concerned – Correct the modified group membership. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Global Group Administrative Activity
Global Group Created
Global Group Member Removed
Global Group Deleted
Global Group Changed


Global Group Member Removed

A user was deleted from a global group or a deletion was attempted.

Sequence: 633.

Security Relevance: Deleting a user from a global group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack on an account.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Correct the modified group membership. Disable user’s account. Notify the user and user’s supervisor.

Concerned – Correct the modified group membership. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Global Group Administrative Activity
Global Group Created
Global Group Member Added
Global Group Deleted
Global Group Changed


Local Group Changed

A local group was modified or a modification was attempted.

Sequence: 639.

Security Relevance: Modifying a local group requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable user’s account. Correct the modified group. Notify the user and user’s supervisor.

Concerned – Correct the modified group. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Local Group Administrative Activity
Local Group Created
Local Group Member Added
Local Group Member Removed
Local Group Deleted


Local Group Created

A new local group was created or creation was attempted.

Sequence: 635.

Security Relevance: Creating a new local group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is creating a new local group to obscure future activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the new group (i.e., remove user rights, etc.). Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Disable the new group. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Local Group Administrative Activity
Local Group Member Added
Local Group Member Removed
Local Group Deleted
Local Group Changed


Local Group Deleted

A local group was deleted or a deletion was attempted.

Sequence: 638.

Security Relevance: Deleting a local group requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Once a group is deleted, the group’s SID can not be reused.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Create a new group to replace the deleted one. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Create a new group. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Local Group Administrative Activity
Local Group Created
Local Group Member Added
Local Group Member Removed
Local Group Changed


Local Group Member Added

A user was added to a local group or an addition was attempted.

Sequence: 636.

Security Relevance: Adding a user to a local group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is obtaining other authorities for himself or others.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the modified account and correct group membership. Disable user’s account. Logoff user. Notify the user and user’s supervisor.

Concerned – Correct the modified group membership. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Local Group Administrative Activity
Local Group Created
Local Group Member Removed
Local Group Deleted
Local Group Changed


Local Group Member Removed

A user was deleted from a local group or a deletion was attempted.

Sequence: 637.

Security Relevance: Deleting a user from a local group requires administrative authority. This action is normally not performed on a daily basis. Worst case, it may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack on an account.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Correct the modified group membership. Disable user’s account. Notify the user and user’s supervisor.

Concerned – Correct the modified group membership. Notify the user and user’s supervisor.

Cautious – Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topics

Local Group Administrative Activity
Local Group Created
Local Group Member Added
Local Group Deleted
Local Group Changed


Notification Package Added by the Security Account Manager

A new notification package was added or addition attempted. The package will be notified of any account or password changes.

Sequence: 518.

Security Relevance: This is a highly unusual event (except at system startup) and may indicate that someone is attempting to detect or intercept security related events.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Shutdown the target immediately and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Concerned – At a convenient time, shutdown the target and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Cautious – At a convenient time, shutdown the target and take off-line for analysis. (Note that NT targets commonly add authentication packages when they startup.)

Audit Policy Settings Required

System Flags: Restart, Shutdown, and System (Success and Failure)

Related topics

NT Starting
Authentication Package Added
Trusted Domain Added
Trusted Domain Removed
Domain Policy Changed


NT Starting

The NT system is booting.

Sequence: 512.

Security Relevance: Systems are sometimes removed from service due to known security vulnerabilities. The booting of these systems may reintroduce the security threat.

Corrective Action:

Critical – Shutdown the target and physically disable. Ascertain who rebooted the target.

Concerned – Shutdown the target.

Cautious – Shutdown the target.

Audit Policy Settings Required

System Flags: Restart, Shutdown, and System (Success and Failure)

Related topics

Authentication Package Added
Notification Package Added by the Security Account Manager
Trusted Domain Added
Trusted Domain Removed
Domain Policy Changed


Password Change Failed

Sequence: 627 – failure.

Security Relevance: May indicate that the user mistyped a password or that the user does not know the original password. If the user does not know the original password, it may be because the account was left logged in and another malicious user is attempting to change the password to gain control of the account.

Corrective Action: Monitor for repeated attempts. If repeated attempts fail:

Critical – Determine if the user changing the password owns the account. Logoff the user. Notify the user’s supervisor and user.

Concerned – Notify the user’s supervisor and user.

Cautious – Notify user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

Password Change Succeeded


Password Change Succeeded

The password on an account was modified.

Sequence: 627 – success.

Security Relevance: Some accounts have non-alterable passwords. If such an account’s password is modified, it might indicate a denial of service attack.

Corrective Action: Correct the password. Determine who modified the password and how.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

Password Change Failed


Successful Logon (All Logon Types)

A user or service successfully logged into the target.

Sequence: 528

Security Relevance: No logons of any type are expected on a target or close (highly sensitive) surveillance of a target is necessary.

Corrective Action: Recheck and re-disable all logons on the target.

Audit Policy Settings Required

System Flags: Logon and Logoff (Success and Failure)


Trusted Domain Added

A new trusted domain was added or addition was attempted.

Sequence: 610.

Security Relevance: Trust relationships between domains should remain fairly constant. A new trust domain may allow unauthorized users access to proprietary information. Unannounced changes to trust domains should be analyzed immediately.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Shutdown the domain’s PDC and take the PDC off-line for analysis. Notify the user and user’s supervisor. Notify the user community.

Concerned – Analyze the domain’s PDC and, if necessary, take off-line. Notify the user and user’s supervisor. Notify the user community.

Cautious – Analyze the domain’s PDC. Notify the user and user’s supervisor. Notify the user community.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topics

NT Starting
Authentication Package Added
Notification Package Added by the Security Account Manager
Trusted Domain Removed
Domain Policy Changed


Trusted Domain Removed

A trusted domain was deleted or deletion was attempted.

Sequence: 611.

Security Relevance: Trust relationships between domains should remain fairly constant. Unannounced changes to trust domains should be analyzed immediately. This may indicate a denial of service attack.

Corrective Action: Analyze the action and whether or not it was successful. If the account is not authorized to perform this action:

Critical – Immediately reestablish the trusted relationship. Disable the user account who removed the trusted relationship. Notify the user and user’s supervisor. Notify the user community.

Concerned – Immediately reestablish the trusted relationship. Notify the user and user’s supervisor. Notify the user community.

Cautious – Immediately reestablish the trusted relationship. Notify the user and user’s supervisor. Notify the user community.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topics

NT Starting
Authentication Package Added
Notification Package Added by the Security Account Manager
Trusted Domain Added
Domain Policy Changed


User Account Changed

A user’s account type was changed or a change was attempted.

Sequence: 625.

Security Relevance: A user’s account type affects the capabilities of the user. An unauthorized increase in capabilities may pose a security risk. Modification of an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program), though, this is an unlikely attack.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the modified account. Investigate the account’s definition through the User Manager and correct. Notify the user and user’s supervisor.

Concerned – Investigate the account’s definition through the User Manager and correct. Notify the user and user’s supervisor.

Cautious – Investigate the account’s definition through the User Manager and correct. Notify the user.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Enabled
User Account Disabled
User Account Deleted
User Right Assigned
User Right Removed


User Account Created

A new user account was created or creation was attempted.

Sequence: 624.

Security Relevance: Creating a new account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is creating a new account to obscure future activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the new account. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Disable the new account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

User Administrative Activity
User Account Type Changed
User Account Enabled
User Account Disabled
User Account Deleted
User Right Assigned
User Right Removed


User Account Deleted

A user’s account was deleted or deletion was attempted.

Sequence: 630.

Security Relevance: Deleting an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity. Once an account is deleted, the account’s SID can not be reused.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Create a new account to replace the deleted account. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Create a new account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Type Changed
User Account Enabled
User Account Disabled
User Right Assigned
User Right Removed


User Account Disabled

A user’s account was disabled or disablement was attempted.

Sequence: 629.

Security Relevance: Disabling an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Enable the disabled account. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Enable the disabled account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Type Changed
User Account Enabled
User Account Deleted
User Right Assigned
User Right Removed


User Account Enabled

A user’s account was enabled or the enablement was attempted.

Sequence: 626.

Security Relevance: Enabling an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is opening a security vulnerability. If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the enabled account. Disable the account performing the action. Logoff the user. Notify the user and user’s supervisor.

Concerned – Disable the new account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: User and Group Management (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Type Changed
User Account Disabled
User Account Deleted
User Right Assigned
User Right Removed


User Right Assigned

New user rights were added to an account or an addition was attempted.

Sequence: 608.

Security Relevance: Adding user rights (e.g., backup, shutdown) to an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program). If the target is normally accessed by non-administrative accounts, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the account performing the action. Logoff the user. Restore the user rights to the modified account. Notify the user and user’s supervisor.

Concerned – Restore the user rights to the modified account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Type Changed
User Account Enabled
User Account Disabled
User Account Deleted
User Right Removed


User Right Removed

User rights were deleted from an account or a deletion was attempted.

Sequence: 609.

Security Relevance: Deleting user rights from an account requires administrative authority. It may indicate that a user has gained administrative authority (for example, via the GetAdmin program) and is performing a denial of service attack on an account. If the target is normally accessed by non-administrative accounts or the account should not be able to modify user rights, it may indicate malicious activity.

Corrective Action: Determine whether or not it was successful. If the account is not authorized to perform this action:

Critical – Disable the account performing the action. Logoff the user. Restore the user rights to the modified account. Notify the user and user’s supervisor.

Concerned – Restore the user rights to the modified account. Notify the user and user’s supervisor.

Cautious – Notify the user and user’s supervisor.

Audit Policy Settings Required

System Flags: Security Policy Changes (Success and Failure)

Related topic

User Administrative Activity
User Account Created
User Account Type Changed
User Account Enabled
User Account Disabled
User Account Deleted
User Right Assigned


Analyzed Logs Properties Dialog Box

This dialog box appears when you select the Analyzed Logs node in the scope (left) pane, right-click the mouse, and choose Properties from the shortcut menu. Use this dialog box to specify where you want to save log files that have been analyzed. This dialog box also displays statistics on the files and events stored in this folder.

Save Log Files In Displays the current folder where event log files that have been analyzed are stored. To change the location of the analyzed event log files, click Browse to display the Browse for Folder dialog box. When you have specified more than one directory for the analyzed event log files, you can click the arrow to change from one location to another.

Note

When you change folders, all of the analyzed logs are moved from the current folder to the new folder.

Total Size Displays the total size of all event log files stored in the folder.

Contains Displays the total number of event log files stored in the folder.

First Event Displays the date and time of the first event log file stored in the folder.

Last Event Displays the date and time of the last event log file stored in the folder.

Duration Displays the total length of time between the first and last events.

No of Events Displays the total number of events found in all event logs files stored in the folder.

No of Users Displays the total number of users included in the event logs.

No of Computers Displays the total number of computers included in the event logs.

Related topics

Analyzing event logs
Specifying log settings


Predefined Report Templates

CyberSafe Log Analyst includes several predefined report templates. You can use these predefined reports, or you can create your own templates on which to generate reports. Configure these reports to view activities within a given time period by user, computer, or activity signature. Selecting object attributes includes the files and/or directories that were accessed.

Note

We recommend that you make a backup copy of the report templates before you modify any of these predefined templates. The report templates are stored in the Reports subdirectory of the CLA directory (for example, \CLA\report).

Activity by Target Use this template to generate reports showing all activities grouped by targets. The default settings for this report are: all users, targets, and signatures selected; sorted by target, signature, object attributes, and count; include all time periods; include a bar chart.

Activity by User Use this template to generate reports showing all activities grouped by users. The default settings for this report are: all users, targets, and signatures selected; sorted by user, signature, object attributes, and count; include all time periods; include a bar chart.

Enterprise Activity Summary Use this template to generate reports showing a summary of all activities across your entire enterprise. The default settings for this report are: all users, targets, and signatures selected; sorted by signature and count; include all time periods; include a bar chart.

Enterprise Failed Login Summary Use this template to generate reports showing the failed logins grouped by target. The default settings for this report are: all users and targets, and Failed Login signatures selected; sorted by count and target; include all time periods; include a bar chart.

Enterprise Object Browsing by Target Use this template to generate reports showing object browsing by target. The default settings for this report are: all users and targets, and the General Object Browsing signature selected; sorted by count, target, and signature; include all time periods; include a bar chart.

Enterprise Object Browsing by User Use this template to generate reports showing object browsing by user. The default settings for this report are: all users and targets, and the General Object Browsing signature selected; sorted by count, user, and signature; include all time periods; include a bar chart.

Enterprise Object Browsing by User & Target Use this template to generate reports showing object browsing by user and target. The default settings for this report are: all users and targets, and the General Object Browsing signature selected; sorted by count, users, target, and signature; include all time periods; include a bar chart.

Enterprise Virus Activity Use this template to generate reports showing areas of potential virus activity, such as the modification to applications, grouped by target. The default settings for this report are: all users and targets, and the General Virus and Trojan Horse signature selected; sorted by count, target, signature, and object attributes; include all time periods; include a bar chart.

Login Summary Report Use this template to generate reports showing login activity across your entire enterprise. The default settings for this report are: all users and targets, and the Failed Logins, Successful Logins, and Three Consecutive signatures selected; sorted by target, user, signature and count; include all time periods; no chart.

Target Statistics Use this template to generate reports showing per hour activities across your enterprise, grouped by target. The default settings for this report are: all users, targets, and signatures selected; sorted by target, signature, and count; by hour; include a bar chart.

User Statistics Use this template to generate reports showing per hour activities across your enterprise, grouped by User. The default settings for this report are: all users, targets, and signatures selected; sorted by user, signature, and count; by hour; include a bar chart.

Related topics

Defining report templates
Modifying report templates
Generating reports