Security Incident Mgmt Playbook / Security Event Monitoring

Table of Content

1. | Four-Phase Security Incident Handling |
2. | Security Incident PlayBook for Typical Security Incidents |
3. | Windows Security Event Monitoring Implementation |
4. | Further Reading 延伸閱讀 |

Four-Phase Security Incident Handling

Back to Top

Security Incident PlayBook for Typical Security Incidents

Back to Top

Windows Security Event Monitoring Implementation

Hundreds of events occur as the Windows operating system and the applications that run on it perform their tasks. Monitoring these events provide valuable information to help administrators troubleshoot and investigate security-related activities.

Based on industry experience & some well recognized guidelines (Australian Cyber Security Centre, Microsoft, and etc.), our Windows Security Event Monitoring (SEM) Implementation focuses on those significant windows security events

·        Key account(s) Logon alert (Privileged Account Usage Monitoring)
·        Failed Account Logon alert (Brute force attack Monitoring)
·        Large amount Files Deletion on File Server detection (Ransomware Monitoring)
·        User’s Network Share Changes Detection (Users’ Own File / Folder Share Monitoring)
·        Changes on Account Rights, Audit Policies alert (Suspicious Account Activity Monitoring)
·        Changes of Scheduled Tasks alert
·        New Device such as USB Drive alert
·        Customizable monitor(s) of all Windows OS Events on Security / Application / System

Back to Top

Further Reading 延伸閱讀

Back to Top