RE: Log checking programs

["Depp, Dennis M." <deppdm () ornl gov>]

You should be able to use logparser from Microsoft to scan through the
logs and send an email of what you consider suspicious.  There is a nice
feature of logparser called checkpoint that will only search from the
last time logparser was run.

Dennis


-----Original Message-----
From: esecuritydude () googlemail com [mailto:esecuritydude () googlemail com]

Sent: Monday, July 24, 2006 5:48 AM
To: security-basics () securityfocus com
Subject: Log checking programs

Hi all,


I am looking for some sort of program to check AD security event logs.
Something or some way to automate checking the logs on the Domain
Controllers and sending reports of suspicious activity to an email or
something. e.g. Failed Logins etc...


Suggestions welcome,


Thanks in Advance,

Miguel

------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------