LogClarity® Solves Audit Trail Forensics
To solve this confusing logon event conundrum and simplify forensics, the duplicate logon events must not be collected. Otherwise, they will contaminate the entire audit trail of activity for all users. A perfect illustration of the power of the LogClarity® intelligence engine can be demonstrated by explaining its ability to accurately collect and report Windows logon events.
LogClarity® utilizes its LCDF technology to analyze all logon events as they occur in real-time. Based on Log Fidelity’s log interpretation research, LogClarity® is able to automatically determine the authentic logon events. LogClarity® automatically correlates the Kerberos request tickets (672 Event) and the successful authentication logon events (673 event), all, in real-time. All other duplicate logon authentication events that occur during that user’s logon session are ignored and not collected.
This solves several issues. The first successful outcome of this technology is that all logon events that are collected are authentic. As a result, all user activity is finally an audit trail timeline. Forensics and data mining become very simple to conduct while log retention is vastly improved. There are no longer thousands of redundant logon events cluttering up the log repository on a daily basis. Reports are clear, concise, and accurate due to the intelligent logon analysis capabilities of LogClarity®.
When looking at event log management solutions, there are some areas that must be looked at closely and all the pros and cons must be considered before purchasing.