MICROSOFT LOG PARSER TOOLKIT
CHAPTER 1 INTRODUCING LOG PARSER IN THIS TOOLBOX A BRIEF BACKGROUND BUILDING QUERIES RETRIEVING FIELDS FROM THE EVENT LOG RETRIEVING FIELDS FROM IIS LOGS SEARCHING FOR INFORMATION USER LOGONS LONG RUNNING PAGES ERROR RESPONSES EVENTS IN THE PAST TWO DAYS EVENTS IN THE PAST THIRTY MINUTES REQUESTS FROM IP ADDRESSES SUMMARIZING DATA AVERAGE REQUEST TIME PER EXTENSION AVERAGE TOTAL REQUEST TIME TOTAL BYTES SENT PER DAY TOTAL BYTES RECEIVED PER HOUR PER CLIENT ORDERING THE OUTPUT FILE AND DIRECTORY LISTINGS TOP TEN LISTS TOP TEN LONG RUNNING PAGES TOP TWENTY LARGEST FILES GATHERING INPUT PARSING TEXT FILES PERFMON CSV FILES NETSTAT OUTPUT LIVE STOCKS RSS FEEDS QUERYING SYSTEM INFORMATION REGISTRY ENTRIES WRITTEN TO IN THE PAST TWENTY FOUR HOURS FILES MODIFIED IN THE PAST TWENTY FOUR HOURS COMPUTERS OWNED BY A DOMAIN ACCOUNT PARSING NETMON FILES RAW NETWORK USAGE CONNECTIONS BY IP ADDRESSES IMPLEMENTING CUSTOM INPUT FORMATS PRODUCING OUTPUT USING THE DATAGRID OUTPUT FORMAT CREATING CUSTOM TEXT FILES EVENT LOG MONITOR HTML PAGE CREATING CHARTS BYTES PER EXTENSION HITS PER HOUR UPLOADING QUERY RESULTS TO A SQL DATABASE CONSOLIDATING IIS LOGS CONVERTING LOG FILE FORMATS FINAL TOUCHES CHAPTER 2 MONITORING IIS MONITORING PERFORMANCE AND USAGE ANALYZING REQUEST DETAILS OBTAINING LONG RUNNING WEB REQUESTS OBTAINING THE MOST POPULAR FTP DOWNLOADS MONITORING ENTRY POINTS MONITORING WEB REFERRERS MONITORING BANDWIDTH USAGE ENSURING STABILITY ANALYZING REQUEST ERRORS IDENTIFYING REQUEST ERRORS UNDERSTANDING ASP ERRORS ANALYZING HTTPERR ERRORS ANALYZING URLSCAN ERRORS SCANNING FOR SECURITY BREACHES ANALYZING ILLEGAL REQUESTS SCANNING FOR FAILED AUTHENTICATION AND UNAUTHORIZED ACCESS SCANNING MALFORMED HTTP REQUESTS SCANNING HTTP VERBS IN CLIENT REQUESTS SCANNING FOR ASP ATTACKS CHAPTER 3 EXPLORING THE WINDOWS EVENT LOG MONITORING USER ACTIVITY VIEWING LOGON LOGOFF ACTIVITY DETAILING USER LOGINS DETERMINING ACTIVE USERS TRACKING AUTHENTICATION FAILURES LISTING FAILED LOGONS IDENTIFYING SINGLE VERSUS MULTIPLE FAILED LOGONS DIFFERENTIATING BETWEEN BENIGN AND WARNING EVENTS IGNORING SUCCESSFUL ENTRIES CORRELATING EVENTS AROUND FAILURES IDENTIFYING BRUTE FORCE ATTACKS IDENTIFYING A BRUTE FORCE AUTHENTICATION ATTACK TRACKING SECURITY POLICY VIOLATIONS DETERMINING LOGON LOGOFF BEHAVIOR AUDITING SUCCESSFUL AND UNSUCCESSFUL FILE ACCESS ATTEMPTS AUDITING UNSUCCESSFUL FILE ACCESS ATTEMPTS AUDITING SUCCESSFUL FILE ACCESS ATTEMPTS TRACKING SYSTEM HEALTH IDENTIFYING BENIGN SYSTEM EVENTS IDENTIFYING SINGLE VS MULTIPLE EVENTS TRACKING SYSTEM FAILURES AUDITING FOR DR WATSON ERRORS AUDITING FOR SYSTEM STARTUPS AUDITING FOR UNEXPECTED SHUTDOWNS TRENDING SYSTEM STARTUPS TRENDING NETLOGON FAILURES CREATING SYSTEM ERROR REPORTS GENERATING A USEFUL SYSTEM ERROR REPORT MONITORING APPLICATION HEALTH IDENTIFYING APPLICATION ERRORS FINDING EVENTS FROM A SPECIFIC APPLICATION FINDING ERROR EVENTS FROM A SPECIFIC APPLICATION AUDITING FOR APPLICATION DR WATSON ERRORS WORKING WITH SERVED APPLICATION SECURITY IDENTIFYING SERVED APPLICATION LOGIN FAILURES IDENTIFYING SERVED APPLICATION SECURITY FAILURES CHAPTER 4 EXAMINING NETWORK TRAFFIC AND PERFORMANCE LOGS WITH LOG PARSER READING NETMON CAPTURE FILES WITH LOG PARSER GETTING INTO THE NETMON FORMAT GETTING STARTED WITH LOG PARSER S NETMON FORMAT FINDING SOFT ERRORS IN TCP REQUESTS LOG PARSER NETMON AND PROXY SERVERS USING NETMON AND LOG PARSER TO WATCH FOR WORMS INTRUDERS DERIVING DATA FROM NT PERFORMANCE LOGS BASIC NT PERFORMANCE LOG QUERIES ADVANCED NT PERFORMANCE LOG QUERIES ADVANCED GRAPHING WINDOWS NT PERFORMANCE DATA WITH LOG PARSER CHAPTER 5 MANAGING SNORT ALERTS BUILDING SNORT IDS REPORTS GATHERING SNORT LOGS BUILDING AN ALERTS DETAIL REPORT MOST COMMON ALERTS ALERTS BY IP ADDRESS