28 March, 2016 | Sarah Greesonbach

Plan Effective SIEM First, Compliance Second

Security information and event management (SIEM) is a major priority for large companies. It’s a reporting process that provides a holistic view of the health of an organization’s IT security as well as important details for various kinds of compliance regulations, including GLBA, PCI, FISMA,...
15 January, 2016 | Adam Bertram

How to Get User Logon Session Times from the Event Log

If you’re a knowledge worker, to be productive in a work environment, you’re probably going to need a user account. And you’re probably going to need to actually use this user account to login to your office and mobile devices. If you don’t, you’re probably not going to be working at that...
6 November, 2015 | Adam Bertram

Windows Event Log Forwarding in Windows Server 2008

I love Active Directory auditing. I love it because with just a couple clicks of the mouse I can easily create a policy that immediately gets applied to 500 servers that begins recording useful information on about everything that goes on involving those servers. What I hate about AD auditing is...
22 September, 2015 | Adam Bertram

Tracking Malicious Windows Server Events with PowerShell

Windows servers can potentially generate thousands—or even hundreds of thousands—of events daily. Most are created from perfectly safe events that system administrators use to get a glimpse of what’s going on. An event might be generated to indicate a disk is running out of free space, an...
16 July, 2015 | Adam Bertram

Easy Event Log Querying with PowerShell

If you’re using any kind of native Active Directory (AD) auditing today you probably love the information it generates in the security event log. Native AD auditing is awesome about generating loads of useful information as to what happened and when. The problem arises when you actually want to...
29 April, 2015 | Russell Smith

Advanced Event Log Filtering Using PowerShell

In a previous blog post, Monitoring Event Logs with PowerShell, I showed you how to use Get-WinEvent to perform basic event log monitoring using PowerShell. In this article, I want to demonstrate how Get-WinEvent can be used to run more complex queries using the –FilterHashtable...
6 April, 2015 | Russell Smith

Monitoring Event Logs with PowerShell

A routine sysadmin task that PowerShell lends itself to is parsing data and text files, and the Windows event logs use XML formatted information that can be easily parsed using the Get-EventLog and Get-WinEvent PowerShell cmdlets. In this article I’m going to show you how to get started using...
3 December, 2014 | Richard Muniz

Detecting a Security Threat in Event Logs

When Windows Server has issues, the first place we go to are the event logs. We want to know what was going on when the trouble began, what applications were running and might have caused it, etc. We are masters at figuring this stuff out. Now take the same event logs and try to sort them out by...
15 August, 2014 | Nick Cavalancia

Can You Make Sense of Your Security Logs?

The average IT Pro doesn't need to be told stories about big data - you've been inundated with log data from dozens of sources for at least a decade before the term "big data" even came to exist. The concept of wanting security log and audit trail data being meaningful is also not new. Why,...
Show more articles
...