Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to collect metrics or generate alerts when one of EMET's suite of mitigations prevents code execution? Ideally I'd want to be able to collect and analyze data to support statements like, "deploying EMET blocked ### exploit attempts against our Windows PCs last year."

share|improve this question
add comment

2 Answers

There does not seem to be an EventID associated with EMET, so it might not be possible to collect those metrics. There really should be a way to do that, though.

Try the Microsoft EMET forums.

share|improve this answer
add comment
up vote 1 down vote accepted

EMET 3.0 has been announced.

With EMET 3.0, we have included an additional new reporting capability that we call "EMET Notifier". When you install EMET 3.0, this lightweight component is set to automatically start with Windows.

EMET events are logged via the event source called EMET. These logs can be found in the Application log. There are three levels: Information, Warning and Error. Information messages are used for logging usual operation such as the EMET Notifier starting. Warning messages are used when EMET settings change. Error messages are used for logging cases where EMET stopped an application with one of its mitigations, which means an active attack has been blocked.

The new version looks like it puts the needed information into the Windows Event Log.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.