What’s New in the Windows 10 Security Log - Seguridad Mania.com - España y América Latina

Randy Franklin Smith of Ultimate Windows Security has been busy researching the changes to audit policy and the security log in Windows 10. He’ll be updating the Security Log Encyclopedia to reflect these changes and I’m going to show you these changes live in this upcoming real training for free ™ webinar. Here’s what to expect: • Microsoft has added a new “Audit Group Membership” subcategory to audit policy that documents all the groups a user belongs to at the moment of logon – whether an interactive logon to a workstation or a remote logon as to a file server. Smith will discuss the interesting ways you can use this information to enhance your monitoring of different types of users. • The other new audit policy, “Audit PNP Activity” allows you to audit connection of external devices by the Windows plug and play system. • Microsoft has new events and more fields to some existing events so that get additional useful information on activity like: Logons, process creation, enumeration of the local SAM account database and changes to Boot Configuration Database (BCD). A lot of these changes are valuable enhancements that will help you catch endpoint security threats more effectively. Furthermore, Smith will show specific examples of these new events and point out the new fields in existing events. LogRhythm, has sponsored this real training for free ™ session. LogRhythm has a new version of their cool SIEM out and Erick Ingleby will demo the new version 7.1. This includes the introduction of a new back-end technology for storing all log data that provides greater scalability, search performance, faster indexing rates, and enables new capabilities such as unstructured search against the full log message text.