LANguard Security Event Log Monitor.

GFI has launched LANguard Security Event Log Monitor (S.E.L.M.), a host-based intrusion detection tool which is a centralized event log security analyzer that retrieves all security event logs from servers and workstations and alerts administrators of breaches for immediate intrusion detection.

Comment:

Traditional intrusion detection products sniff network traffic, and are therefore `blinded" by the use of switches, IP traffic encryption and high-speed data transfer. Furthermore, conventional intrusion detection tools rely on attack patterns; however these are constantly changing and therefore the attack pattern database is almost immediately outdated.

LANguard, scans the Windows NT/2000 security event logs in real time monitors then logs for significant security events and compares them to a rule base. Such events would include, for example, failed object access to confidential files, logon failures occurring in the network, user accounts changes and additions, successful logon of a user outside office hours.

LANguard S.E.LM also archives all security events in a centralized location, allowing for reporting and forensic analysis. This system can view, log on and log off times of all network users, view trends, or see which machine is attacked most. It also can identify users who are creating too many events such as failed log ons, failed object access, etc. The reports enable administrators to obtain important information about security activity on the network. For more product information, visit

http://www.gfi.com/languard/lanselm.htm.