It is imperative that audit data be protected from modification. Ifpossible, an attacker will erase or modify the contents of audit logs. Obviously, choosing what to collectis critical. Collect too little, and you risk missing the data you needto recognize an attack and identify the culprit. Collect too much and yourisk being overwhelmed by the hay with small chance of finding the needle.
Analytic engines search for events that typify security problems andanomalous activity.
An example of the first is an event that violates securitypolicies or matches known attack profiles, such as multiple failed log-onattempts. Anomalous activity might be a user logging on at 4 a.m. for thefirst time in several years. Auditing and intrusion-detection systems usually generate alarms uponthe detection of one or both such cases. Upon investigation, most alarmsturn out to be acceptable, if unusual, activities. Even so, we have establishedaccountability and responsibility for the event that caused the alarm.