Using NetCrunch for compliance and security audits

Transcription

1 Using NetCrunch for compliance and security audits AdRem NetCrunch 6.x Tutorial

2 2011 AdRem Software, Inc. This document is written by AdRem Software and represents the views and opinions of AdRem Software regarding its content, as of the date the document was issued. The information contained in this document is subject to change without notice. Any access to or use of this White Paper is conditioned on the following: The information in this White Paper is believed by AdRem Software to be accurate and reliable, but is not guaranteed. All use of and reliance on this White Paper are at the reader s sole risk. AdRem Software is not liable or responsible for any damages, losses or expenses arising from any error or omission in this White Paper. This White Paper does not constitute an endorsement, recommendation or guarantee of any of the products tested. The testing does not guarantee that there are no errors or defects in the products, or that the products will meet the reader s expectations, requirements, needs or specifications, or that they will operate without interruption. This White Paper does not imply any endorsement, sponsorship, affiliation, or verification by or with any companies mentioned in this report. This White Paper is for informational purposes only. ADREM SOFTWARE MAKES NO WARRANTS, EITHER EXPRESS OR IMPLIED, IN THIS DOCUMENT. AdRem Software encourages the reader to evaluate all products personally. AdRem Software and AdRem NetCrunch are trademarks or registered trademarks of AdRem Software in the United States and other countries. All other product and brand names are trademarks or registered trademarks of their respective owners, and no endorsement of, sponsorship of, affiliation with, or involvement in, any of the testing, this White Paper or AdRem Software is implied, nor should it be inferred. AdRem Software, Inc. 410 Park Avenue, 15th Floor New York, NY USA Phone: +1 (212) Fax: +1 (212) adrem@adremsoft.com Web site: Follow us and get the latest AdRem Software news:

3 Tracking Windows Event Log to check who logged or tried to log to the company Windows servers during particular period of time can be used to detect and investigate suspicious activity on the server. It can also simplify troubleshooting problems related to the user accounts. NetCrunch helps you cut through the huge volumes of Windows Event Log entries to identify and track the suspicious logs that may require immediate action or be included in the periodical compliance reports. This tutorial goal is to show you how to Enable Windows Event Log monitoring in NetCrunch Define new event related to specific type of log entries that we want to track in the Windows machines. Enabling monitoring of the Windows Event Logs Windows Event Log monitoring is disabled in NetCrunch by default. If you decide to collect Windows Event logs, you need to enable this feature first. 1. Open the Options window by selecting Tools > Options from the main menu. 2. Go to Monitoring > Windows Event Log page. 3. Select the Enable Windows Event Log Monitoring check box. 4. Use OK button to confirm settings. 3

4 While doing it, you can also specify the reconnect time interval. For better overview of identical logs, opt to use the mechanism of grouping same log entries together. Creating new Received NTLog Entry Event of Suspicious Logon Activity The Logon/Logoff category of the Windows Security log shows all attempts to access the local computer. One of the easiest methods for diagnosing intrusion attempts to the local system is the regular checking for the Failure Audit events. Failure Audit includes events with the following Event IDs (listed are just the most important ones): 529 Unknown user name or bad password 531 Account currently disabled 532 The specified user account has expired 533 User not allowed to logon at this computer 534 The user has not been granted the requested logon type at this machine 539 Account locked out 4625 this Event ID represents of all the above (on Windows 2008) 4

5 To enable tracking all the above events when they happen, create a new Event Definition in one of the NetCrunch Monitoring Policies (e.g. Security Audit): 1. Open Map Monitoring Policy window. 2. Hit Add Event icon from the window toolbar -- a new window opens. 3. Go to Windows tab and expand group called Received NTLog Entry Event. 5

6 4. Double-click the <Select to create new Received NTLog Entry Event> to create new event. 5. Specify the desired conditions in the provided fields. 6

7 6. Hit OK to confirm changes. From now on, NetCrunch will gather all events with the particular Event IDs from each machine in your network and will notify you about suspicious behavior that may indicate attempts of intrusion attack. All these events will be stored in the NetCrunch Event Log. From the NetCrunch Event Log toolbar, you can easily switch between the views to display only those that belong to the Security Audit application group. 7

8 And there s what it looks like: 8