Security event log reports

WasteTimeChangingCars · 21 Mar 2012 at 14:42

I recently started at an IT support company and part of my remit is to review the company’s network monitoring system, packetTrap. This software reports very well on network performance but the operations manager doesn’t like the reports it produces for security logs. Some security log reports are short about 5 pages and very long 40-100 pages depending on how large the company is that we monitor. What makes the reports long is events that happens multiple times and PacketTrap has no way of grouping/condensing duplicate events.

I’ve written an excel macro that will delete the duplicate events but then you can’t see how many times that event happened i.e. 20 failed login attempts from user x.

Does anyone have any suggested monitoring platforms that can summarise duplicate security events? I’ve already showed my boss (operations manager) EventLog Analyzer from manage engine but he’s hesitant to buy something that does one small thing.

anything I don't mind · 21 Mar 2012 at 15:07

You could try and use PRTG but might be a bit tricky to set up for what you want to do.

I know it can monitor event logs and supports multiple sites and it doesn't require client or device agents. uses snmp and wmi etc. But I am not sure if it can generate reports specific to say failed login attempts.

http://www.paessler.com/manuals/ipcheck_server_monitor/eventlogsensorlocalorremote.htm

ecksmen · 21 Mar 2012 at 17:29

I personally would avoid anything manage engine produce. We use applications manager for years and had nothing but constant issues with it, their support was equally dire!

WasteTimeChangingCars · 21 Mar 2012 at 19:24

thanks for your suggestions much appreciated

Hulkster · 25 Mar 2012 at 18:12

Take a look at Splunk

In a nutshell...It is a tool for gathering/analyzing/reporting on all manner of application data.