Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Using HBSS 4.5 as a local monitoring tool

Posted on 2012-03-13
4
Medium Priority
?
1,695 Views
Last Modified: 2013-12-09
I've been asked to configure HIPS to monitor tasks/events on a local machine. This request comes of a possible security violation and we want to monitor everything this user is doing for a while..  I've set HIPS to Log All but it's only giving me info that woulb be considered an intrusion.. I've even set Application Blocking to Learn mode, in hope it would log more..  I need to capture everything this user is doing.. Basically I need HIPS to log the Task manager..  Is there a way to get HIPS or any module in HBSS to log all event/Tasks that are bing executed?

I personally think HBSS may not be the tool they need in accomplishing this issue but I needed to ask around before makeing the argument..
0
Comment
Question by:hotrobb
  • 2
  • 2
4 Comments
 
LVL 16

Accepted Solution

by:
legalsrl earned 2000 total points
ID: 37714855
Hiya,
HIPS won't do it as it's designed to block intrusions, not monitor the user.
Basically what you are doing is trying to spy on the user.Have you connected the machines event viewer remotely ?
Thanks
Simon
0
 

Author Comment

by:hotrobb
ID: 37714914
Yeah I agree, I had to make sure I wasn't missing something..  I have to ask when you say connecting to the machines "Event Viewer Remotely", in what context were you speaking of?  I'm not sure of a way to conect to it remptly with out and RDP session or somthing similar that would alert the user of the monitoring..
0
 
LVL 16

Expert Comment

by:legalsrl
ID: 37714950
Hiya
If you open Event Viewer and choose Action, Connect to another computer, you can then download the event logs
Cheers
Si
0
 

Author Comment

by:hotrobb
ID: 37715072
Right, I remeber now.. Thanks for the info..
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like me and like multiple layers of protection, read on!
This article covers the basics of data encryption, what it is, how it works, and why it's important. If you've ever wondered what goes on when you "encrypt" data, you can look here to build a good foundation for your personal learning.
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question