EventsManager 7.1, 50 user
Network-wide event log management – no need to be an event guru!
Event logs are a valuable tool to monitor network security and performance that are often underutilized due to their complexity and volume. As organizations grow in size, they require a more structured approach towards event log management and retention. A recent survey carried out by SANS Institute found that 44% of system administrators do not keep logs more than a month.
Proper event log management helps you to meet several objectives including:
- Information system and network security.
- System health monitoring.
- Legal and regulatory compliance (SOX, PCI DSS, HIPAA).
- Forensic investigations.
Network-wide analysis of event logs made easy
As a network administrator, you have experienced the cryptic and voluminous logs that make log analysis a daunting process. GFI EventsManager is a log processing solution that provides network-wide control and management of Windows event logs, W3C logs, and Syslog events generated by your network sources. GFI EventsManager includes an intelligent event processor which processes logs and presents information in a centralized, easy and user-friendly fashion.
"Translates" cryptic windows events
Cryptic logs make log analysis a lengthy process. GFI EventsManager “translates” the often cryptic event descriptions to clear, concise explanations and suggestions for action.
Centralized event logging
Event logs are constantly and automatically generated by a user or by an automatic/background process and logs are often stored in disparate locations. GFI EventsManager stores all captured event logs into one SQL database that may also reside remotely. You may also configure scheduled backups of your event logs.
High performance scanning engine
GFI EventsManager incorporates a totally re-designed event scanning engine that is fine-tuned for maximum scanning performance. Tests demonstrate that it is able to scan and collect up to 6 million events/hr. Furthermore, its plug-in based methodology allows additional features and modules to be integrated without interfering with existing code.
Real-time alerts
GFI EventsManager can send you alerts when key events or intrusions are detected. You can trigger actions such as scripts or send an alert to one or more people by email, network messages, and SMS notifications sent through an email-to-SMS gateway or service.
Extended event log support
GFI EventsManager processes various event log types including Windows event logs, Syslog events, and W3C event logs. This allows you to collect more data from the different hardware and software systems that are most commonly available on a typical corporate network.
Collect events data distributed over a WAN into one central database
The Database Operations module allows you to collect events data from GFI EventsManager installations on multiple sites and locations across your network into a central database. This enables you to easily monitor thousands of workstations and servers across the network without impacting on bandwidth and storage use. This paid add-on integrates and centralizes events collected and processed and allows you to backup/restore events on demand. Through database operations you can manage the size of the database – without the need for manual intervention – not only through centralization but by also being able to export events and back them up as needed.
Rule-based event log management
GFI EventsManager ships with a pre-configured set of log processing rules that allow you to filter and classify events that satisfy particular conditions. You can run these default rules without performing any configuration or you can choose to customize these rules or create tailored ones that suite your network infrastructure.
Advanced event filtering features
GFI EventsManager’s powerful filtering sieves through the recorded event logs and allows you to browse the required events without deleting any records from your database backend. You may also selectively highlight specific events using a color or the integrated event finder tool.
Event log scanning profiles
Scanning profiles allow you to configure the set of event log monitoring rules that will be applied to a specific computer or to a group of computers and provide a centralized way of tuning event log processing rules. You can also setup a set of rules that only apply to workstations in a particular department. You may also create separate complementary profiles that provide additional and more specialized event log rules on a computer by computer basis.
Helps to comply with PCI DSS and other regulations
As from September 2007 all businesses handling cardholder data – irrespective of size – have to be fully compliant with strict security standards drawn up by the world’s major credit card companies. Data logging is key to meeting PCI DSS requirements since logs provide audit trails of all activities in a credit card holder data environment and hence, a comprehensive log management system, such as GFI EventsManager, would provide you with the functionality you need to help you become PCI DSS compliant.
