© 2011 ZOHO Corp. All Rights Reserved ManageEngine® EventLog Analyzer 7 Collects, Analyzes, Reports and Archives on Applications, Systems and Device Logs for Internal Threat Management and Regulatory Compliance www.eventloganalyzer.com © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

© 2011 ZOHO Corp. All Rights Reserved Preview What is Event Log / Syslog? Why Event Log Management? Introducing EventLog Analyzer Log Management Stages Product Brief Features & Benefits EventLog Analyzer Customers Demo Q & A 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

What is Event Log / SysLog? (1/2) Windows computers use this logging system (go to Start > Settings > Control Panel > Administrative Tools > Event Viewer) Consist of: Security Log – related to security or rights events Application Log – related to Non-OS events System Log – any other event, like startup messages, device errors, etc. 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

What is Event Log / SysLog? (2/2) The logging system that Unix systems like Linux, Solaris, BSD, etc., use. (go to /var/log/messages) All the activities of a system are logged as event log or Syslog. Both event log and Syslog are similar. (from hereon we will be using event log to collectively refer to Event Log and SysLog) 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Why Event Log Management? Security Information Event Management [SIEM] for IT Operations & Compliance Audit staff Regulatory compliance for PCI-DSS, HIPAA, FISMA, SOX, and GLBA acts Monitor and Audit Privileged User activities Ensures System Security and Policy enforcement Troubleshoots when things go wrong in the network Monitors systems for optimal performance Secured storage of Log data for internal and compliance audit 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Introducing EventLog Analyzer (1/3) EventLog Analyzer is: a Log Collecting and Analyzing software a Compliance Reporting tool for PCI-DSS, HIPPA, FISMA, SOX and GLBA regulatory acts an activity monitoring software 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Introducing EventLog Analyzer (2/3) EventLog Analyzer helps you to: Determine unauthorized user access attempts and other policy violations Assess and mitigate internal user threats Understand security risks in your network Identify trends in user activity, server activity, peak usage times, etc. Understand server and network activity in real-time 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Introducing EventLog Analyzer (3/3) Zero-in on applications causing performance and security problems Monitor critical servers exclusively and set alerts Alert on hosts generating large amounts of log events indicating potential threats Identify applications and system hardware that may not be functioning optimally Do a root cause analysis of security incidents 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

EventLog Analyzer - Distributed Edition Higher Scalability Distributed Monitoring 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved 9

EventLog Analyzer: Log Management Stages Collects event logs from Windows, Linux, UNIX - Solaris hosts, and Switches & Routers. Collect Stage 1 Analyzes the configured systems for unusual activities, non-compliant behavior etc., and raises alerts Analyze Stage 2 Instant or Schedule reports based on events, trends, and compliance behavior. Report Stage 3 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

© 2011 ZOHO Corp. All Rights Reserved Product Brief Product scope: Supported Hosts include Windows, Unix (all flavors), devices like Routers, Switches, IBM AS/400 & any other syslog devices, & applications like IIS Web server, IIS FTP server, DHCP Linux, DHCP Windows, Oracle & MS SQL. Target Customers: IT Operations & Compliance Audit staff. MSPs and MSSPs. Data Collection: WMI/DCOM for Windows, Syslog for others. Auto discovery supported. Scalability: 600 (heterogeneous) Hosts/Applications per installation of ELA. Deployment Flexibility: Download, install and run on Windows 2000, XP,Vista,7, Servers 2003 & 2008, Linux (all flavors). Both 32-bit & 64-bit CPUs are supported 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2007 ZOHO Corp. All Rights Reserved

Product Brief (continued) Incident management and workflow support: Event & Host-based Alerts & Reports can be scheduled and reports can be Emailed (PDF, CSV, Zip). User Management: Administrator, Operator, & Guest user privileges. Import Active Directory & RADIUS users. Data Repository: Bundled MySQL database, Support for MS SQL database and archive data storage is compressed (.zip) Reporting: Pre-defined reports (includes compliance reports) & custom reports. Reports can be exported in PDF, HTML & CSV formats 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2007 ZOHO Corp. All Rights Reserved

Features & Benefits (1/5) Comprehensive Event Collection – Collects security, application and system event log data from enterprise-wide Windows, UNIX systems, Routers, Switches, IBM AS/400, other Syslog devices & Applications. Normalizes and stores them all in a centralized event database. Analyzes Native language logs with i18N support. Collects logs without Agent and optional Agent Pre-built Event Reports – Comprehensive reports include top reports on events generated across hosts, users, processes, and host groups, apart from top events by count. Compliance Reports – Generates pre-defined reports to meet PCI-DSS, HIPAA, FISMA, SOX and GLBA compliance requirements. 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Features & Benefits (2/5) PUMA Reports – Internal privileged user monitoring and reporting to mitigate internal user threat Instant Reports – Generate reports in real-time and get instant access into last events generated. View last ten events generated, for any host from which event logs are collected. Customizable Report Profiles – Build custom report profiles with event filters and report format options tailored to meet your specific needs. Build report profiles from advanced search results. Report Schedule and Distribution – Automatically generate reports at specified time intervals and get them delivered via Email. Multiple Report Formats – Generate and view reports in HTML, PDF and CSV formats. 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved 14

Features & Benefits (3/5) Trending – View trend of events based on event severity and event type. Trend on alerts triggered is available. Real-time Alerting & Automatic Notification – Automatically notifying you the alerts on a specific host criteria set by you. Email, SMS, & SNMP Traps Security Analysis – Identify unauthorized and failed logins, and malicious user(s). Set alerts for suspicious hosts, and monitor events exclusively. Secured Log Archive – Can archive collected system logs for compliance audit, network audit, and forensic analysis. The archive log data is encrypted, hashed and time stamped to make it secured and tamper proof 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Features & Benefits (4/5) Log Import - Import Windows Event Logs (.evt format), Syslogs and generate Reports. Powerful Filters – Define event filter to specify criteria such as event type, severity, hosts, etc., in reports. Multi-level drill-down – Drill down from event reports to see specific event details about a host / host group or application. Advanced Search – Search any event (raw log) using advanced search. Save the result as report profile. Host Grouping – Group hosts together based on your business needs, generate event reports, and analyze trend patterns exclusively. Anytime, Anywhere Access & Management – Monitor hosts and generate reports from just a web browser. Rebranding – It allows client UI rebranding for the use of MSPs and MSSPs 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Features & Benefits (5/5) OS Support – Can be installed and run on Windows and Linux systems making it suitable for deployment in a wide range of enterprises. 32-bit and 64-bit CPUs supported. Host OS Support – Can collect logs from Windows & Linux systems. Can collect logs across platforms. Device Support – Can collect log from (Cisco) Routers & Switches, IBM AS/400 and any syslog supporting devices. Application Support – MS IIS Web & FTP servers, DHCP Linux, DHCP Windows, VMWare, Oracle and MS SQL servers. Bundled Database – integrated MySQL database configured to store all log data. No external database configuration required. MS SQL database is supported. 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

EventLog Analyzer - Editions EventLog Analyzer is available in three editions: Professional Premium Distributed Premium Editions contains all the features of the Professional Edition plus the following features: Application Log Analysis Support for MS SQL server backend database Optional Agent based log collection For the list features available for the editions, visit: http://www.eventloganalyzer.com/eventloganalyzer-editions.html 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2007 ZOHO Corp. All Rights Reserved

EventLog Analyzer – Road Map Server specific reports - Server Audit, File Server, Printer File integrity monitoring 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2007 ZOHO Corp. All Rights Reserved 19

Customers Using EventLog Analyzer Our customers include Accenture Ricoh NEC Blue Cross US Navy Raytheon, Office of the Secretary of State of Washington, and many other global corporations & governments. For the list of customers, visit: http://www.eventloganalyzer.com/customers.html 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2007 ZOHO Corp. All Rights Reserved 20

Live Demo @ http://demo.eventloganalyzer.com/ © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

© 2011 ZOHO Corp. All Rights Reserved Q & A © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved

Thank You For more information Website: www.eventloganalyzer.com Email: eventlog-support@manageengine.com Phone US: +1 888 720 9500 Phone Inlt: +1 925 924 9500 Twitter: @LogGuru 11/7/2018 © 2011 ZOHO Corp. All Rights Reserved © 2005 ZOHO Corp. All Rights Reserved