The windows event log

As an introduction to windows event logging I recommend reading the following article: Monitoring and Troubleshooting Using Event Logs. It's the first interesting one I've found after googling for an introduction.

Quoting the article, which also talks about EventCombMT.exe which we'll mention later:

This article reviews best practices for working with Windows event logs including how to interpret 
event messages, how to configure event logs, how to search and filter events, how to view events on 
remote systems, and how to use EventCombMT.exe and other tools to monitor events on multiple systems.

Introduction

In order to answer to a recent forum post I had to do a quick research since it had been some time since I last tested this.
The exact question was:

Hello,

Is there a document talking about how the directives are processed?  One question
that I have is if you have multiple directives created and an event comes in
that matches the initial states of more than a single directive will both actually
process the event, or only the first match (which I think is the case)?

Thanks for any clarification you can provide.

Stephen

• SSH password failed (plugin_sid 1)
• SSH password accepted (plugin_sid 7)

• Test directive 21, grouping one login failure and one success
• Test directive 22, grouping one login failure and one success
• Test directive 23, used in the second case, grouping those two

This tutorial tries to show the first common steps you could perform if you're new to ossim and just finished installation, without knowing what to do next.
The tutorial will cover:

• Policies
• Initial Inventory
• Scans
• Scheduled scans
• What to do next

1. The need. The Hype.

Compliance

• ISO27001/17799
• SOX
• HIPAA
• PCI
• Basel II
• NIST 800-53
• Many more...

Centralized logging

Data mining

Some time ago, earlier this year, I had the opportunity to attend to a conference where one of the leading SIM vendors (according to gartner's magic quadrant at least) talked about their product. Although my opinion will always be biased and I tend to compare all that I see on this area with OSSIM, I also believe that I've got a solid base to judge others.
Anyway, since I know myself and making a review comparing more than five years of work with a 5 hour demo and some document browsing isn't fair, I won't say the name of this product.

We've just posted a new document at http://www.ossim.com. You can see it on the right, it's a case study about a deployment we've done this summer.

The environment was very interesting, around 6000 people doing all sort of weird things on a very high traffic and throughput environment. Get the actual document, it's marketing focused so it does have some very nice sounding phrases in it ;-).

In a couple of months there's another campus party, this time at Sao Paulo, Brazil. I'm pretty sure OSSIM will be present there too and we'll be having fun again. (Not forgetting the hard work, I only were a couple of days there, before the event, but my two co-workers Juan and Roberto did a great job working 14-hour shifts).

Following are a couple of pictures I took at the last event:

Well, kindof at least...

Since Apple's iPhone is basically a stripped down MacosX and it has some nice toys to play with, I thought I'd give the provided python port a try and fire up the OSSIM agent. As expected everything worked like a charm and getting ossim up & running was very easy. Here is the rest of it.