Chapter 10 - Configuring and Using Auditing and the Event Logs

Abstract

Auditing is the process of analyzing gathered data for the purpose or intent of determining a possible problem or, in the security arena, an attack or exploit. Auditing is best used on any system that can generate some type of log file that one can save, refer to, and analyze over time. This chapter outlines the importance of auditing in the process of configuring and managing configuration. The considerations of configuring and managing auditing include Windows events, Internet formation services, firewall log files, network monitor log, and remote access service log files. Understanding the auditing process and intrusion detection in general helps a person determine who is—or was-responsible for an attack and when the attack was carried out. The chapter also explains the methods of managing audit log retention and managing distributed audit logs by using EventComb. Using these methods can help find patterns of attack, the time of attack, how the attack was carried out, and how to log that attack and analyze it.