X

Download Event Logs Management PowerPoint Presentation

SlidesFinder-Advertising-Design.jpg

Login   OR  Register
X


Iframe embed code :



Presentation url :

Home / Business & Management / Business & Management Presentations / Event Logs Management PowerPoint Presentation

Event Logs Management PowerPoint Presentation

Ppt Presentation Embed Code   Zoom Ppt Presentation

PowerPoint is the world's most popular presentation software which can let you create professional Event Logs Management powerpoint presentation easily and in no time. This helps you give your presentation on Event Logs Management in a conference, a school lecture, a business proposal, in a webinar and business and professional representations.

The uploader spent his/her valuable time to create this Event Logs Management powerpoint presentation slides, to share his/her useful content with the world. This ppt presentation uploaded by worldwideweb in Business & Management ppt presentation category is available for free download,and can be used according to your industries like finance, marketing, education, health and many more.

About This Presentation

Slide 1 - 1 Event Logs Management Anthony LAI, CISSP, CISA Founder & Editor InfoSec Hong Kong
Slide 2 - 2 Why do I come up an idea to present this? First of all, I am not the event log expert but the one suffered from event log burden.  Think of ideas to improve it in a bank. No budget and complicated approval process there , forcing me to seek for free software.
Slide 3 - 3
Slide 4 - 4 InfoSec Hong Kong www.infosechk.org Goal Promote security awareness to public and education sectors. Our advantages We act as a bridge between security concepts and commercial solutions Members Over 370 registered members Enjoy discounted products from our sponsors Current Status Over 64,000 visit since Aug 2004 News, seminar, training, advertisement, consultancy service for SMEs. Future Reflect the voice to government from public and focus on more security education and provide solutions to public. It is a long term commitment Invitation for more commercial sponsorship
Slide 5 - 5 Author Profile Anthony Lai a speaker for the International Information Systems Security Certification Consortium, Inc. [(ISC)2®], the non-profit international leader in educating, qualifying and certifying information security professionals worldwide. (ISC)2 issues the Certified Information Systems Security Professional (CISSP) and Systems Security Certified Practitioner (SSCP) credentials and related concentrations to those meeting necessary competency requirements. Anthony is also a founder and editor of the “InfoSec Hong Kong” Website with over 300 registered public members. He currently is a chapter leader of OWASP (The Open Web Application Security Project- HK Chapter) and serves as a program committee member in PISA (Professional Information Security Association) and ISSA (HK Chapter). His major interest is in web application security, various penetration tests and forensics. He is a column writer on information security in Hong Kong local newspaper – “Apple Daily”. He has certified as CISSP and CISA.
Slide 6 - 6 What will I cover? Event Logs Monitoring Problems Solutions (You may most concern about it) Demonstration (You may most be interested in it ) Experience sharing among all of you.
Slide 7 - 7 Real-Case: Event Log Monitoring Problem in a Bank It have 50 systems, and 12 windows servers and other legacy systems. In the past, the one taking the information security officer just use his “X-Ray” Eyes to scan over all the Logs print-outs (over 400~600 papers) to detect errors every working day (Remark: I believe he is readily a superman, otherwise, he will be blind!) No filtering, No selection for critical events. Use half day to review the logs. No standard document about log review process. No solutions from other branches in other countries.
Slide 8 - 8 Real-Case: Event Log Monitoring Problem in a Bank Their current solutions: Print out the event logs with heaps of papers, and glance over it and then chop, chop chop with their signature. Package them up and put into the inventory Auditor has no comment on this kind of log review process.
Slide 9 - 9 The Challenges Bureaucratic approval process ( I can’t count how many tiers I need to pass even I just want to get a few thousand dollars) Free and cost saving Efficient to solve the problem Shorten the log review time Automate the log download process Patch the log file with appropriate headers and format. Save our world, save papers! In addition, increase the opportunity to detect any critical events and suspicious activity. No one has knowledge in this area.
Slide 10 - 10 What did I suggest to bank? Long Term Security Operation Center (SOC) (but I think it is too early because I cannot find they have put some efforts in Incidence Response Planning and Implementation) Logs Filtering and Processing Server Short & Mid Term Commercial event log review software
Slide 11 - 11 Roadmap to building log processing standard Log Nature and Element Define the elements needs for a log records What are the critical events? Operation Log patching, download, process and retention as well as purging. Review What are we looking at? The procedure to report any suspicious events.
Slide 12 - 12 More challenges from my observation Various systems with various standard in logging -> Hard to integrate. Cultural problem and political problem No one thinks about the system infrastructure.
Slide 13 - 13 Log Wiping Risk and Attack
Slide 14 - 14 Event Logs Monitoring Tools Microsoft Log Parser 2.2 http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx Kiwi Syslog Products: http://www.kiwisyslog.com/Syslogs Remstats - http://remstats.sourceforge.net/release/log-server.html Set up a Linux log server http://www.linuxsecurity.com/content/view/117514/49/
Slide 15 - 15 Log Parser Search for Data - Search for the logons of a specific user among the events in the Windows Event Log: C:\>LogParser "SELECT TimeGenerated, SourceName, EventCategoryName, Message INTO report.txt FROM Security WHERE EventID = 528 AND SID LIKE '%TESTUSER%'" -resolveSIDs:ON
Slide 16 - 16 Log Parser (2) Create Reports - Create custom-formatted HTML reports.
Slide 17 - 17 Log Parser (3) Calculate Statistics -Calculate the distribution of the HTTP response status codes from your IIS log files: C:\>LogParser "SELECT sc-status, COUNT(*) AS Times INTO Chart.gif FROM <1> GROUP BY sc-status ORDER BY Times DESC" – chartType:PieExploded3D -chartTitle:"Status Codes" And produce a chart formatted as desired:
Slide 18 - 18 Log Parser - Syntax Examples: LogParser "SELECT date, REVERSEDNS(c-ip) AS Client, COUNT(*) FROM file.log WHERE sc-status<>200 GROUP BY date, Client" -e:10 LogParser file:myQuery.sql?myInput=C:\temp\ex*.log+myOutput=results.csv LogParser -c -i:BIN -o:W3C file1.log file2.log "ComputerName IS NOT NULL" Help: -h GRAMMAR : SQL Language Grammar -h FUNCTIONS [ ] : Functions Syntax -h EXAMPLES : Example queries and commands -h -i: : Help on -h -o: : Help on -h -c : Conversion help
Slide 19 - 19 Log Parser – Sample Output Server EventID Total ------- ------ ----- HKGKABS1 528 420 HKGKABS1 529 1 HKGKABS1 538 419 HKGKABS1 539 1 HKGKABS1 576 420 HKGKABS1 578 2 HKGUATS1 528 73 HKGUATS1 538 71 HKGUATS1 576 73 HKGUATS1 578 11  …………. Statistics: ----------- Elements processed: 1130 Elements output: 10 Execution time: 0.19 seconds
Slide 20 - 20 From logs download to output reports (1a) Automatic Download strTarget = ""“P:\SecurityLogs\log\t_Server1.txt""" Set objShell = CreateObject("WScript.Shell") Set objExec = objShell.Exec("cmd.exe /C dumpel -f " & strTarget & " -s Server1 -d 1 -l security -c -format dtIucs") strPingResults = LCase(objExec.StdOut.ReadAll) ‘dumpel is an executable to download logs
Slide 21 - 21 From logs download to output reports (1b) DUMPEL Usage: dumpel -f file [-s \\server] [-l log [-m source]] [-e n1 n2 n3..] [-r] [-t] [-d x] -d Filters for event last days (number larger than zero) -e nn Filters for event id nn (up to 10 may be specified) -f Output filename (default stdout) -l Dumps the specified log (system, application, security) -b Dumps a backup file (use -l to specify file name) -m Filters for events logged by name -r Filters out events logged by name (must use -m too) -s Remote to servername -t Use tab to separate strings (default is space) -c Use comma to separate fields -ns Do not output strings -format Specify output format. Default format is dtTCISucs where t - time d - date T - event type C - event category I - event ID S - event source u - user c - computer s - strings
Slide 22 - 22 From logs download to output reports (2a) strTarget1 = ""“Q:\log\window\script\Daily\header.txt""" strTarget2 = ""“P:\SecurityLogs\log\" & genmonth & genday & "t_Server1.txt""" ‘Copy log files to target directory with appended header Set objShell = CreateObject("WScript.Shell") Set objExec = objShell.Exec("cmd.exe /C copy " & strTarget1 & "+" & strTarget & " " & strTarget2) strPingResults = LCase(objExec.StdOut.ReadAll) `Invoke and run Log Parser, it outputs chart. Set objShell = CreateObject("WScript.Shell") Set objExec = objShell.Exec("cmd.exe /C P:\SecurityLogs\Logparser.exe file:P:\SecurityLogs\EventIDDistrib_Overview.sql?sourcefile=P:\SecurityLogs\2005log\" & genmonth & genday & "t_Server1.txt+destfile=P:\SecurityLogs\BarChart\" & genmonth & genday & “Overview_Server1.gif -i:csv -o:CHART -charttype:BarClustered -categories:ON -values:ON -charttitle:Event_Logs_Overview_Report_" & genmonth & genday & “Server1 -legend:ON -groupsize:1024x700") strPingResults = LCase(objExec.StdOut.ReadAll)
Slide 23 - 23 From logs download to output reports (2b) ‘Output CSV file with logs breakdown Set objShell = CreateObject("WScript.Shell") Set objExec = objShell.Exec("cmd.exe /C P:\SecurityLogs\Logparser.exe file:P:\SecurityLogs\EventIDDistrib_with_selected_event_ID.sql?sourcefile=P:\SecurityLogs\log\" & genmonth & genday & "t_Server1.txt+destfile=P:\SecurityLogs\BarChart\" & genmonth & genday & "Selected_Server1.csv -i:csv -o:csv") strPingResults = LCase(objExec.StdOut.ReadAll)
Slide 24 - 24 Event Logs Review Process (3) Add the header to the beginning of the file. Date,Time,EventID,SourceName,Dummy,Server,Description . They are used in the SQL query. SQL Query in the EventIDDistrib_with_selected event_ID.sql: SELECT StrCat(TO_STRING(EventID),Description) as EventID_And_Source,Count(*) as Total FROM %sourcefile% To %destfile% WHERE EventID in (529; 530; 531; 532; 535; 537; 539;608; 609; 612; 613; 614; 615; 616; 617; 620; 624; 625;626; 627; 628; 629; 630; 631; 632; 633; 634; 635; 636;637; 638; 639; 640; 641; 642; 643; 644; 645; 646; 647;648; 649; 650; 651; 652; 653; 654; 655; 656; 657; 658;659; 660; 661; 662; 663; 664; 665; 666; 667; 675; 676; 677) GROUP BY EventID_And_Source
Slide 25 - 25 Final Log Review Report Element Scope and Content Which servers do we monitor? Grand Total Figures: It shows no. of logs for each event for every server Group the events into different categories: Appendix with detailed event statistics Statistics with no breakdown. Detailed statistics breakdown with log description Appendix of selected critical events
Slide 26 - 26 Group the events for the management report
Slide 27 - 27 Critical Events Selection Windows Server Event Different parties will have different risk ranking on particular event.
Slide 28 - 28 Challenge again… How to justify the event is not suspicious? How to filter out those duplicated event logs further? We need to keep an eye on any new patch or/and updates, it may add some new event we have not captured.
Slide 29 - 29 Current weakness No co-relation could be drawn. No short-cut, all manual effort in investigation
Slide 30 - 30 Incidence Response or Ignorance Response? Again, log filtering and review is not a goal, we need to response any irregularities once it is discovered. One more mindset from CEO: “We are doing “XXXX” business, not “information security”! If the IR is reviewed once a year due to the coming of HKMA, generally, the staff and management awareness is lacking, it is hard to go ahead, may be, people may response with ignorance.
Slide 31 - 31 Summary Logs are here, but not the one you desire. Logs are obtained but useless if you don’t know how to review. Logs are reviewed but useless if there is no process to response. Shorten the Fault Detection Time. However, it needs management support. As an system architect, they may need to discuss with other architects and security officer about log facilities for better management and integration.
Slide 32 - 32 Resources An unofficial Log Parser support site http://www.logparser.com/ Log Parser Toolkit (book) http://www.syngress.com/catalog/?pid=3110 How to generate web-based report (I have discussed with others in http://www.logparser.com) , search “How to create a customized HTML report?” in the forum. Understanding Windows Logging http://www.windowsecurity.com/articles/Understanding_Windows_Logging.html Tutorial and Tools http://www.windowsecurity.com/pages/search.asp?query=Log+Monitoring
Slide 33 - 33 Any questions? Please feel free to share with me. You could reach me at anthonylai@infosechk.org or anthonylai@owasp.org
 

Frequently Asked Questions

> About SlidesFinder?

Slidesfinder is a website that allows users to upload and share their PowerPoint presentations online. It provides a platform for individuals and businesses to share their ideas and knowledge through presentations, and for others to view and download these presentations for educational or professional purposes.
Slidesfinder offers a wide range of presentation topics and categories, including business, education, science, technology, health, and more. Users can also search for presentations using keywords, tags, or by category. The website provides tools to create professional presentations with rich media, animations, and graphics.



One of the key features of Slidesfinder is its user-friendly interface, which allows users to easily upload, view, and share presentations. Users can also embed their presentations in their websites or blogs using the website's embed code feature.
Slidesfinder also offers premium services, such as the ability to create private presentations and to download presentations in high-quality formats. However, the basic features of Slidesfinder are free to use, making it accessible to anyone who wants to share their ideas and knowledge through presentations.

> How do I register with SlidesFinder?

Go to registration page (you can see signup link on top of website page) https://www.slidesfinder.com/signup . If you have facebook/gmail account them just click on SIGN IN WITH FACEBOOK OR SIGN IN WITH GOOGLE button, by this you will be a registered member of slidesfinder without filling any form, required detail automatically will be fatch from your account. If you do not a Facebook account, then click on "Signup". Fill all required fields and you will be a registered member of slidesfinder.

> Is slidesfinder account confirmation is mandatory?

Yes it is mandetory to active your account to login.

> Do I need to signup/login on SlidesFinder before uploading a PowerPoint presentation?

Yes, you need to login with your account before uploading presentation. Your username will be displayed on your uploaded presentation. Your registered email id is needed for sending your stats of uploaded presentation.

Slidesfinder is a sharing website for PowerPoint presentations search and share. Find your interest in the form of powerpoint presentations on slidesfinder and save your valuable time . On Slidesfinder you get presentations from our huge library of professional ppt presentations. We believe in making your search INFORMATIVE and FUN. Find your best ppt presentation from a pool of PowerPoint presentations stacked under important industry categories like business & management, heath & Wellness,eduction & training etc. We provide unique informative PowerPoint presentation for marketers, presenters and educationists. These professional PowerPoint presentations are uploaded by professionals from across numerous industry segments.These ppt presentations are available for FREE download.

Not just finding your interest, but facilitate you broadcast your interest. We have created this platform for easy sharing of PowerPoint presentations, ensuring that these presentations get maximum exposure. Create your slidesfinder account and upload PowerPoint presentations for free, share on social media platforms and BUILD YOUR CROWD WITH PRESENTATION !!

The Great Buddha says, "Share your knowledge.It’s a way to achieve immortality"! So, start sharing knowledge and we are here to make that immortal !!

© 2013-2022 SlidesFinder. All rights reserved.

Re-productivity of content are not allowed. Without prior written permission from author, commercial use of any content is illegal.