InTrust

Product overview of InTrust

Smart and scalable event log management

Your organization’s most valuable asset is its data and the users that have access to it — but you’re only as secure as your user workstations. Collecting, storing and analyzing all user and privileged account data generally requires large amounts of storage, time-consuming collection of event data and in-house expertise about the event data collected. That’s where we come in.

Only with Quest InTrust, you can monitor all user workstation and administrator activity from logons to logoffs and everything in between. Slash storage costs with 20:1 data compression, and store years of event logs from Windows, UNIX/Linux servers, databases, applications and network devices. InTrust real-time alerting enables you to immediately respond to threats with automated responses to suspicious activity.

Download Free Trial Request Pricing

Features
Tour
Specifications
Resources
Support & Services

Features

Single pane of glass

Collect and store all native or third-party workstation logs from various systems, devices and applications in one, searchable location with immediate availability for security and compliance reporting. InTrust delivers a unified view of Windows event logs, UNIX/Linux, IIS and web application logs, PowerShell audit trails, endpoint protection systems, proxies and firewalls, virtualization platforms, network devices, custom text logs, as well as Quest Change Auditor events.

User workstation monitoring

Protect your workstations from modern cyberattacks, such as pass-the-hash, phishing or ransomware, by monitoring user and administrator activity — from logons to logoffs and everything in between. Collect and store all essential details of user access, such as who performed the action, what that action entailed, on which server it happened and from which workstation it originated.

Simplified log analysis

Consolidate cryptic event logs from disparate sources into a simple, normalized format of who, what, when, where, where from and whom to help you make sense of the data. Unique, full-text indexing makes long-term event data easily searchable for fast reporting, troubleshooting and security investigation.

Smart, scalable event log compression

Collect and store massive volumes of data in a highly-compressed repository, 20:1 with indexing and 40:1 without, so you can save on storage costs by up to 60% and ensure continuous compliance with HIPAA, SOX, PCI, FISMA and more. Additionally, one InTrust server can process up to 60,000 events per second with 10,000 agents writing event logs simultaneously, giving you more efficiency, scalability and substantial hardware cost savings. And if you need more volume, you can simply add another InTrust server and divide the workload — scalability is virtually limitless.

Real-time alerting and response actions

Watch for unauthorized or suspicious user activity so you can respond to threats immediately with real-time alerts sent directly via email or to monitoring applications like System Center Operations Manager. You can then automatically trigger responses to these suspicious events, such as disabling the offending user, reversing the change and/or enabling emergency auditing.

Tamper-proof logs

Protect event log data from tampering or destruction by creating a cached location on each remote server where logs can be duplicated as they are created.

Integration with SIEM solutions

Forward all log data collected from Windows servers and network devices to a security information and event management (SIEM) solution of your choice. InTrust supports customizable event output formats to seamlessly integrate with a wide variety of SIEM solutions.

Improved Insights with IT Security Search

Leverage the valuable insights from all of your Quest security and compliance solutions in one place. With IT Security Search, you can correlate data from InTrust, Change Auditor, Enterprise Reporter, Recovery Manager for AD, and Active Roles in a Google-like, IT search engine for faster security incident response and forensic analysis. Easily analyze user entitlements and activity, event trends, suspicious patterns and more with rich visualizations and event timelines.

Automated best practice reporting

Easily convert investigations into multiple report formats, including HTML, XML, PDF, CSV and TXT, as well as Microsoft Word, Visio and Excel. Schedule reports and automate distribution across teams or choose from a vast library of predefined best practice reports with built-in event log expertise. With data import and consolidation workflows, you can even automatically forward a subset of data to SQL Server for further advanced analysis.

Tour

Collection searches

Automate real-time gathering of Windows event logs from a single console.

Pre-defined searches

Use pre-defined searches to zero in on critical event data.

Interactive user sessions

See details of user logon sessions including duration and location.

Export built-in reports

Export built-in reports for troubleshooting and review.

Download Free Trial Request Pricing

Specifications

Default Set of Components

The components installed by default are InTrust Deployment Manager, InTrust Server and InTrust Repository Viewer. If you customize the selection to install individual components, see the requirements for the components you need in the InTrust System Requirements document supplied in the product download. If you use the default selection, the combined requirements are as follows:

Architecture: x64

Operating System

Microsoft Windows Server 2016
Microsoft Windows Server 2012 R2

Microsoft Windows Server 2012
Microsoft Windows Server 2008 R2

CPU

Min. 4 cores (for example, for evaluation purposes).

For any real-world uses, at least 8 cores are recommended.

Memory

Min. 4GB (for example, for evaluation purposes).

For any real-world uses, at least 8GB are recommended.*

Additional Software and Services

Microsoft .NET Framework 4.5 or later with all the latest updates

Microsoft SQL Server Native Client 11.0.6538.0 or later (version 11.0.6538.0 redistributable package of the client is included in the InTrust distribution) Important: Install the required version of the client in advance, and only then install InTrust.

In a virtualized environment: If you deploy InTrust on a virtual machine, make sure the CPU and memory requirements above are met, and do not overload the virtual machine host.

For the configuration database: