InTrust

Collect and store all native or third-party workstation logs from various systems, devices and applications in one, searchable location with immediate availability for security and compliance reporting. InTrust delivers a unified view of Windows event logs, UNIX/Linux, IIS and web application logs, PowerShell audit trails, endpoint protection systems, proxies and firewalls, virtualization platforms, network devices, custom text logs, as well as Quest Change Auditor events.

Protect your workstations from modern cyberattacks, such as pass-the-hash, phishing or ransomware, by monitoring user and administrator activity — from logons to logoffs and everything in between. Collect and store all essential details of user access, such as who performed the action, what that action entailed, on which server it happened and from which workstation it originated.

Consolidate cryptic event logs from disparate sources into a simple, normalized format of who, what, when, where, where from and whom to help you make sense of the data. Syslog data, in particular, differs drastically from application to application. With InTrust, you can detect structured data inside syslog events and parse this data correctly. Unique, full-text indexing makes long-term event data easily searchable for fast reporting, troubleshooting and security investigation.

Collect and store massive volumes of data in a highly-compressed repository, 20:1 with indexing and 40:1 without, so you can save on storage costs by up to 60% and ensure continuous compliance with HIPAA, SOX, PCI, FISMA and more. Additionally, one InTrust server can process up to 60,000 events per second with 10,000 agents writing event logs simultaneously, giving you more efficiency, scalability and substantial hardware cost savings. And if you need more volume, you can simply add another InTrust server and divide the workload — scalability is virtually limitless.

Watch for unauthorized or suspicious user activity, such as file creation beyond threshold limits, using file extensions of known ransomware attacks or fishy PowerShell commands. Respond to threats immediately with real-time alerts. InTrust enables you to easily trigger automated responses to suspicious events, like blocking the activity, disabling the offending user, reversing the change and/or enabling emergency auditing.