Filtering events forwarded to SIEM with InTrust

Hello, everyone. Today, I'm going to demo how to use the new pre-built filters to forward only high value security data to your scene. Most organizations we meet with rely heavily on SIEM tools to collect, correlate, and analyze log data from a variety of systems across the entire IT infrastructure. But using SEIMs to check every log with security value can be overwhelming and costly. Not every log has to be sent through your SIEM. You can store long term event log data with interest, and then use a set of event forwarding filters that incorporate best practices from many industry resources. For this demo, we have a very simple setup with a single collection. The collection is quite big though. You can see it has more than 1,000 computers. Data from them goes into the default repository. Right now, event forwarding is disabled for the repository. We're going to turn it on and tweak its settings, so that unnecessary fluff is ignored. The filters we're going to use are new in InTrust 11.4.1, designed specially for event transfer to SIEMs. We'll select all of them. This will forward events that match any of them in any combination. Let's apply our changes and watch the progress. You can see we have some pretty busy forwarding going on, and we're getting a good filtering rate. Andros Deployment Manager only refreshes the statistics every couple of minutes. So if you want real time feedback you can check the performance counters by storing long term data in interest, and limiting scene data to what's required for analytics. Organizations can save big on licensing costs annually. That concludes this demo. Thanks for watching. For more information, visit the Quest Interest web page.