Detecting the activity of hackers and insiders is never easy. Enterprises may have the best of network security solutions to detect network anomalies and mitigate them, but enterprise assets still continue to get compromised. Protecting your network from every attack is impossible, but there is one reliable source that can help you track down the activity of hackers and insiders - Your Log Data. IT administrators need to conduct forensic investigation by searching their log data to track down the network intruder and network problems. Your log data has a detailed record of all activities that happened on the network. IT administrators should leverage the network security intelligence provided by their machine generated log data.

Manually searching your log data is impossible since you have to go through thousands of event records. Wouldn't it be great if you could just type certain keywords and get what you are searching for in seconds? This would totally eliminate you from the painful process of searching through the logs manually. Using EventLog Analyzer's Log Search functionality, you can get the precise information you need to take proactive measures to secure your network and mitigate network threats.

EventLog Analyzer's Log search engine

EventLog Analyzer's Log search functionality is very easy and allows you to do a free form search. When a user enters a search criterion in the search bar, EventLog Analyzer rapidly drills down into the raw logs and retrieves the results for your search query. The search criteria can consist of Wild-cards, Phrases, and Boolean operators. EventLog Analyzer also allows you to do Grouped searches and Range Searches. EventLog Analyzer does not limit you to a set of predetermined fields while conducting a search. You can search using event ids, severity, source, username, IP address, etc. or combination of all to meet your search requirement.

EventLog Analyzer's log search helps users to perform log forensic analysis. Users can easily drill down through terabytes of raw log data and get what they are looking for, using EventLog Analyzer's log search functionality.

Log Search using Basic Search and Advanced Search

EventLog Analyzer provides two different log search capabilities; the Basic Search and the Advanced Search. Both search capabilities provide powerful log search capabilities for your log data. EventLog Analyzer's Basic and Advanced search allows network administrators to precisely pinpoint the exact log entry which caused the security activity, find the exact time at which the corresponding security event had happened, who initiated the activity and also, the location from where the activity originated.

Basic Search

EventLog Analyzer's Basic Search allows users to search for anything by just typing the search query in the search box. While typing the search query the user gets auto suggestions thus making the search process more simplified. Basic search permits users to use Wild-cards, Phrases, and Boolean operators while framing their search query. Grouped searches and Range Searches can also be conducted when using basic search.

Advanced Search

EventLog Analyzer's Advanced Search has much more sophisticated search capabilities but the ease of use remains the same like basic search. Advanced Search is used when the user is trying to do a root cause analysis by correlating multiple events and attributes. Advanced Search enables users to search by executing the search against multiple search criterion groups at one time. Filters can also be used with Advanced Search, to filter out certain events types, severity and other attributes.