The agents are small programs that collect, compress, and encrypt the data.
Managers process the data looking for signatures that represent security events.
These tools combined with a universal log file interface, rules-based expert system, and statistical profiling engine comprise the CMDS package. The universal log parser provides a means for a security administrator to import log and event data into CMDS to support particular environment or requirement. Audit and event data from a variety of commercial and in-house developed applications can be sent to the CMDS manager for parsing, intrusion signature recognition, and statistical profiling. CMDS uses a rules-based expert system to evaluate all logged events for attack signatures. This includes over 90 actual events ranging from failed logins, to unauthorized software executions, to file and directory access, and to misuse of administrative privileges.