InTrust 11.4.2 - InTrust Reports

Report Pack for SUSE Linux

This section contains a list of reports included in the InTrust11.4.2 Report Pack for SUSE Linux.

Administrative Activity

• Account Management
• Policy Changes

Account Management

SUSE Linux group management

This InTrust report shows instances of group creation and deletion. Click the Details link for a particular group to see the details of the group management action in a sub-report.

SUSE Linux group membership management

This InTrust report shows instances of members being added to groups and removed from groups. You can organize information in several ways for convenient analysis.

SUSE Linux user management

This InTrust report shows instances of user account creation and deletion. Click the Details link for a particular user to see the details of the user management action in a sub-report.

Policy Changes

SUSE Linux configuration files modifications

This InTrust report shows instances of plain text file modification. This lets you find out whether changes were made to particular Linux configuration files. The report displays when strings were added or removed, but does not include the actual changes. If a line was modified, the report treats this as a combination of line deletion and line addition.

Syslog

All SUSE Linux syslog Events

This InTrust report is designed for manual analysis of Red Hat Linux Syslog messages. Use filtering by date and time, host, message source and message content to find out the information you need.

SUSE Linux failed login attempts

This InTrust report shows details of failed Linux login attempts.

SUSE Linux login statistics

This InTrust report shows how many successful and failed Linux logins occurred within the specified period of time. It also displays the number of cases when there were multiple consecutive failed logins, which indicates possible password-picking activity.

SUSE Linux multiple failed login attempts

This InTrust report shows details of situations when multiple failed Linux login attempts occurred in a row. Click a number in the Count column for a particular attempt to view the original Syslog messages about each attempt.

SUSE Linux user sessions

This InTrust report shows details of the start and finish of Linux user sessions.

Reports for Syslog

This section contains a list of reports included in the InTrust11.4.2 Knowledge Pack for Syslog.

Syslog

All Syslog events

This InTrust report shows all syslog events were gathered by InTrust for Syslog.