Event Log Soft ware

Joe Beagle

New Member
Joined
Jan 29, 2020
Log Monitoring Software for Windows 10 - is there a software in windows 10 where we can track the websites we visit and some sort of security tracker to manage the software being visited remotely or checking the workflow remotely?
 
This is a pretty broad topic and I'll try to provide some insight. Windows by default doesn't track much of the type of information you're looking for so you'd have to install software and potentially other systems to help keep track of it all. If this is for a home network and you're not experienced in setting up servers and network configuration it may not be something you wish to pursue .

For tracking web requests you would likely want to setup a border firewall that also supports a web proxy or a separate web proxy server. You'd also want to restrict HTTP and HTTPS calls to only the web proxy and configure all of the devices to query the proxy. You'd also want to restrict DNS to the firewall so that all DNS queries have to go through it or your approved DNS server(s)

Free Firewalls (you would still need hardware to run on them)
IPCOP, Smoothwall, Sophos UTM Home, ClearOS

Free web proxy
Squid Proxy

For tracking application usage there are both expensive commercial EDR solutions and some free. EDR has the benefits of being able to action on defined conditions and killing processes you don't want running or other actions.

If all you're interesting in is knowing what applications are being run you could configure sysmon (a free tool from SysInternals, now part of Microsoft) which can be configured to log all sorts of events such as process creation/terminatation, registry access, named pipes, WMI calls, DNS, network calls and stores it in an event log. This log is by default a rolling log so they will override older events and they will be stored on the system itself. To centralize the collection and prevent log loss you'd want to set up a SIEM server there are some free offerings but they all require a lot of hardware to run and expertise to maintain.

Free SIEM + HIDS
AlienVault ( I believe still have a free home use license)

If you need me to expand on a topic or have other questions feel free to ask.
 
This is a pretty broad topic and I'll try to provide some insight. Windows by default doesn't track much of the type of information you're looking for so you'd have to install software and potentially other systems to help keep track of it all. If this is for a home network and you're not experienced in setting up servers and network configuration it may not be something you wish to pursue .

For tracking web requests you would likely want to setup a border firewall that also supports a web proxy or a separate web proxy server. You'd also want to restrict HTTP and HTTPS calls to only the web proxy and configure all of the devices to query the proxy. You'd also want to restrict DNS to the firewall so that all DNS queries have to go through it or your approved DNS server(s)

Free Firewalls (you would still need hardware to run on them)
IPCOP, Smoothwall, Sophos UTM Home, ClearOS

Free web proxy
Squid Proxy

For tracking application usage there are both expensive commercial EDR solutions and some free. EDR has the benefits of being able to action on defined conditions and killing processes you don't want running or other actions.

If all you're interesting in is knowing what applications are being run you could configure sysmon (a free tool from SysInternals, now part of Microsoft) which can be configured to log all sorts of events such as process creation/terminatation, registry access, named pipes, WMI calls, DNS, network calls and stores it in an event log. This log is by default a rolling log so they will override older events and they will be stored on the system itself. To centralize the collection and prevent log loss you'd want to set up a SIEM server there are some free offerings but they all require a lot of hardware to run and expertise to maintain.

Free SIEM + HIDS
AlienVault ( I believe still have a free home use license)

If you need me to expand on a topic or have other questions feel free to ask.
Yes, Agreed
 
Log Monitoring Software for Windows 10 - is there a software in windows 10 where we can track the websites we visit and some sort of security tracker to manage the software being visited remotely or checking the workflow remotely?

I would suggest Splunk. Splunk focuses its log monitoring services around enterprise customers who need very concise software for searching, diagnosing and reporting all events that surround data logs. The software is built in such a way to entirely support the process of indexing and deciphering logs of all kinds. It will work with structured, unstructured, and complex applications logs based on a multi-line approach.
 
You'd want a dedicated server to host Splunk and you'd have to either forward or install an agent to harvest the computer logs and would also likely to grab the router logs if it supports it.
 
Back
Top Bottom