EventLog Analyzer

Section 404 - Management Assessment of Internal Controls and (to some extent) Section 302 - Corporate Responsibility for Financial Reports of the Sarbox or SOX act, lays the foundation on how IT can aid SOX compliance.

EventLog Analyzer lets corporations collect, retain and review terabytes of audit trail log data from all sources to support Sarbanes-Oxley Section 404's IT process controls. These logs form the basis of the internal controls that provide corporations with the assurance that financial and business information is factual and accurate.

The types of reports that EventLog Analyzer provides for SOX Audits are as follows:

• User Logon Report:
  SOX requirements (Sec 302 (a)(4)(C) and (D) - log-in/log-out monitoring) clearly state that user accesses to the system be recorded and monitored for possible abuse. Remember, this intent is not just to catch hackers but also to document the accesses to medical details by legitimate users. In most cases, the very fact that the access is recorded is deterrent enough for malicious activity, much like the presence of a surveillance camera in a parking lot.
• User Logoff Report:
  SOX requirements (Sec 302 (a)(4)(C) and (D) clearly state that user accesses to the system be recorded and monitored for possible abuse. Remember, this intent is not just to catch hackers but also to document the accesses to medical details by legitimate users. In most cases, the very fact that the access is recorded is deterrent enough for malicious activity, much like the presence of a surveillance camera in a parking lot.
• Logon Failure Report:
  The security logon feature includes logging all unsuccessful login attempts. The user name, date and time are included in this report.
• Audit Logs Access Report:
  SOX requirements (Sec 302 (a)(4)(C) and (D) - review and audit access logs) calls for procedures to regularly review records of information system activity such as audit logs.
• Object Access Report:
  Identify when a given object (File, Directory, etc.) is accessed, the type of access (e.g. read, write, delete) and whether or not access was successful/failed, and who performed the action.
• System Events Report:
  Identifies local system processes such as system startup and shutdown and changes to the system time or audit log.
• Host Session Status Report:
  Indicates that someone reconnected to a disconnected terminal server session. (This is only generated on a machine with terminal services running.)
• Security Log Archiving Utility:
  Periodically, the system administrator will be able to back up encrypted copies of the log data and restart the logs.
• Track Account Management Changes:
  Significant changes in the internal controls sec 302 (a)(6). Changes in the security configuration settings such as adding or removing a user account to a administrative group. These changes can be tracked by analyzing event logs.
• Track User Group Changes:
  Tracking event logs for changes in the security configuration settings such as adding or removing a global or local group, adding or removing members from a global or local group,etc..
• Track Audit Policy Changes:
  EventLog Analyzer lets corporations comply with internal controls sec 302 (a)(5) by tracking the event logs for any changes in the security audit policy.
• Successful User Account Validation Report:
  Identifies successful user account logon events, which are generated when a domain user account is authenticated on a domain controller.
• UnSuccessful User Account Validation Report:
  Identifies unsuccessful user account logon events, which are generated when a domain user account is authenticated on a domain controller.
• Track Individual User Actions Report:
  EventLog Analyzer lets corporations comply with internal controls sec 302 (a)(5) by auditing user activity.
• Track Application Access:
  EventLog Analyzer lets corporations comply with internal controls sec 302 (a)(5) by tracking application process.