Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
2.4 Log Management
The Windows event log contains lots of different information about events that have
happened on the system. Microsoft TechNet (2007) describes the event log as a
service that logs event messages issued by programs and the operating system. Event
Log reports contain information that can be useful in diagnosing problems.
“Because of the widespread deployment of networked servers,
workstations, and other computing devices, and the ever-increasing
number of threats against networks and systems, the number, volume,
and variety of computer security logs has increased greatly. This has
created the need for computer security log management, which is the
process for generating, transmitting, storing, analyzing, and disposing
of computer security log data.” Souppaya (2006)
Souppaya (2006) continue to describe some of the uses of audit logs, and that they can
provide information about such things as detecting attacks, fraud, and inappropriate
usage. With all these events happening on a network it is important to have some sort
of method for being able to ensure their integrity, keep them secure and monitor them.
2.4.1 Log Correlation
This is a technique that is used to bring together of all the different types of logs that
are generated, and by using the timestamps on each of the events, create a timeline of
these events.
A problem identified by Forte (2005) and Souppaya (2006) is the time stamping of
logs, when logs are generated they are time stamped using the internal clock of the
host and these can be inaccurate and this will have a knock on effect to the logs. For
proper correlation the time stamping needs to be accurate, however Forte (2005)
mentions that there is a reliance on NTP and this may open up a series of noted
vulnerabilities. Souppaya (2006) gives an example of how this would cause a
problem, “timestamps might indicate that Event A happened 45 seconds before Event
B, when Event A actually happened two minutes after Event B”.
17