3

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?

Assuming I can aggregate them into a report what information should I include in Standard Operating Procedures (SOP) reviews?

Improve this question

1 Answer 1

Reset to default
2

For log analysis OSSEC has a few files with MS specific rules designed to extract interesting security events. To see individual rules one can peruse these files:

[/var/ossec/rules]# ls -l ms*
-r-xr-x--- 1 root ossec 31423 Sep 7 2010 msauth_rules.xml
-r-xr-x--- 1 root ossec 11978 Sep 7 2010 ms_dhcp_rules.xml
-r-xr-x--- 1 root ossec 1547 Sep 7 2010 ms-exchange_rules.xml
-r-xr-x--- 1 root ossec 2077 Sep 7 2010 ms_ftpd_rules.xml
-r-xr-x--- 1 root ossec 2190 Sep 7 2010 ms-se_rules.xml

For the latest copy of these rules files you can head over to bitbucket -> https://bitbucket.org/dcid/ossec-hids

(under Source -> ossec-hids / etc / rules /)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .