Security Visibility Assessment Tools
Interactive tools to evaluate your security logging capabilities and identify visibility gaps
Select the logging capabilities currently implemented in your environment:
Network Devices
Logging of both allowed and denied traffic through firewalls
Authentication events for remote access VPN connections
Network Address Translation logs for tracing true source IPs
Application identification and logging in Next-Generation Firewalls
Decryption and inspection of encrypted traffic for security analysis
Endpoint Security
Logging of process creation events with command-line parameters
Monitoring of file creation, modification, and deletion events
Tracking of Windows registry modifications
Monitoring of PowerShell, WMI, bash, and other script execution
Logging of memory injection and other memory-based attacks
Identity & Access Management
Logging of successful and failed authentication attempts
Tracking of account creation, deletion, and modification events
Monitoring of privilege and group membership modifications
Multi-factor authentication events and bypass attempts
Modifications to directory services and domain controllers