Insider Threat Detection Using Microsoft Log Files

Many threats to a network are not detected in a timely manner. Some are found hours or even days after the threat occurs. This research enhances threat detection in networks by parsing log data from the Windows event viewer. The data is processed in real time, and the notification of a threat results in the immediate sending of an email alertto the administrator. This notification is an imperative first step which alerts administrators of a possible threat that needs to be fully investigated. It was found that timely auditing of all components of the Microsoft Event Log, along with a script running to monitor these events on all network systems, can alert an administrator immediately of a potential threat situation on the network via email, resulting in more efficient defense tactics.

This work has been selected by scholars as being culturally important, and is part of the knowledge base of civilization as we know it. This work was reproduced from the original artifact, and remains as true to the original work as possible. Therefore, you will see the original copyright references, library stamps (as most of these works have been housed in our most important libraries around the world), and other notations in the work.

This work is in the public domain in the United States of America, and possibly other nations. Within the United States, you may freely copy and distribute this work, as no entity (individual or corporate) has a copyright on the body of the work.

As a reproduction of a historical artifact, this work may contain missing or blurred pages, poor pictures, errant marks, etc. Scholars believe, and we concur, that this work is important enough to be preserved, reproduced, and made generally available to the public. We appreciate your support of the preservation process, and thank you for being an important part of keeping this knowledge alive and relevant.