I've been asked to configure HIPS to monitor tasks/events on a local machine. This request comes of a possible security violation and we want to monitor everything this user is doing for a while.. I've set HIPS to Log All but it's only giving me info that woulb be considered an intrusion.. I've even set Application Blocking to Learn mode, in hope it would log more.. I need to capture everything this user is doing.. Basically I need HIPS to log the Task manager.. Is there a way to get HIPS or any module in HBSS to log all event/Tasks that are bing executed?
I personally think HBSS may not be the tool they need in accomplishing this issue but I needed to ask around before makeing the argument..