Posts Tagged ‘event logs forensics’

In recent years, the press has widely covered high-profile cases related to threats and incidents caused by malicious software. Attackers have become more inventive.

Splunk Enterprise is the leading platform for real-time analytics. Splunk Enterprise simplifies the collection, analysis and use of technology.

There are several blogs on the Internet that tell you about a suitable method for monitoring Windows event log entries through Elasticsearch. It explains how to perform this process, including some documents from the Elastic team. This process requires a lot of effort to do it right.

Shusey Tomonaga describes how the “LogonTracer” tool works and how to run it. JPCERT / CC developed and released the LogonTracer tool, which supports this analysis of the event log.