Daily Host Alerts Report

by David Schwalenberg
December 18, 2013

This report presents systems and users identified by the Daily_Host_Alert LCE event.

The LCE event Daily_Host_Alert generates, once per day, an alert the first time an event from a local host (such as a DNS lookup or LCE client connect) is seen. For systems like servers that are always on, there will be a spike around midnight for these events. Other computers may start out their day at various times. This report can be used to look for anomalies such as unknown systems or users popping up, or unexpected activity blackouts from known systems.

Note that this report might be very long (hundreds of pages), depending on the number of systems and users on the network. Consider modifying the report definition and filtering on an asset to produce a more specific and more manageable report.

The report is available in the SecurityCenter 4.7 Report app feed, an app store of dashboards, reports, and assets.  The report requirements are:

  • SecurityCenter 4.7
  • LCE 4.2.1

Chapters

Daily Host Alerts Trend (Last 5 Days) - This chapter presents a line graph of Daily_Host_Alert events by time for the last 5 days.

Daily Host Alerts: Hosts (Last 5 Days) - This chapter presents a table of all hosts associated with at least one Daily_Host_Alert event in the last 5 days. Verify that all hosts in this list are authorized to access the network. 

Daily Host Alerts: Users (Last 5 Days) - This chapter presents a table of all users associated with at least one Daily_Host_Alert event in the last 5 days. Verify that all users in this list are authorized to access the network. 

Appendix: New Hosts and Users Discovered (Last 5 Days) - This appendix presents tables of new hosts and new users discovered in the last 5 days. These tables can be used to correlate discovered hosts and users with the Daily_Host_Alert events.