Event log management software. Your organization’s most valuable asset is its data and the users who have access to it — but you’re only as secure as your user workstations. Collecting, storing and analyzing all user and privileged account data generally requires large amounts of storage, time-consuming collection of event data and in-house expertise about the event log data collected. That’s where we come in.Quest InTrust is smart, scalable event log management software that lets you monitor all user workstation and administrator activity from logons to logoffs and everything in between. Slash storage costs with 20:1 data compression, and store years of event logs from Windows, UNIX/Linux servers, databases, applications and network devices. InTrust real-time log monitoring and alerting enables you to immediately respond to threats with automated responses to suspicious activity.
Events per second
Storage cost savings
Collect and store all native or third-party workstation logs from various systems, devices and applications in one, searchable location with immediate availability for security and compliance reporting. Get a unified view of Windows event logs, UNIX/Linux, IIS and web application logs, PowerShell audit trails, endpoint protection systems, proxies and firewalls, virtualization platforms, network devices, custom text logs, as well as Quest Change Auditor events.
Protect your workstations from modern cyberattacks, such as pass-the-hash, phishing or ransomware, by monitoring user and administrator activity — from logons to logoffs and everything in between. Collect and store all essential details of user access, such as who performed the action, what that action entailed, on which server it happened and from which workstation it originated.
One InTrust server can process up to 60,000 events per second with 10,000 agents or more writing event logs simultaneously, giving you more efficiency, scalability and substantial hardware cost savings. And for large, enterprise organizations who need more volume, you can simply add another InTrust server and divide the workload — scalability is virtually limitless.
Leverage the valuable insights from all of your Quest security and compliance solutions in one place. With IT Security Search, you can correlate data from InTrust, Change Auditor, Enterprise Reporter, Recovery Manager for AD, and Active Roles in a responsive Google-like, IT search engine for faster security incident response and forensic analysis. Easily analyze user entitlements and activity, event trends, suspicious patterns and more with rich visualizations and event timelines.
Easily convert investigations into multiple report formats, including HTML, XML, PDF, CSV and TXT, as well as Microsoft Word, Visio and Excel. Schedule reports and automate distribution across teams or choose from a vast library of predefined best practice reports with built-in event log expertise. With data import and consolidation workflows, you can even automatically forward a subset of data to SQL Server for further advanced analysis.
Protect event log data from tampering or destruction by creating a cached location on each remote server where logs can be duplicated as they are created.
With InTrust and Change Auditor, we have confidence that all changes and other actions are properly audited and tracked, and all the data is automatically consolidated and stored in an encrypted repository.Zaid Al-Ali Infrastructure & Service Delivery Manager, Abu Dhabi Ports Read Case Study
I believe the product offers invaluable security reporting and alerting capabilities. While other products do similar things, I feel that InTrust is positioned to enable a quick implementation that delivers immediate value in the audit and compliance arena.Senior IT Manager, Fortune 500 Automotive & Transport Company
We are using Quest InTrust for management of event logs in an environment where auditing is turned up way too high. We are looking at Splunk for analytics and are in the process of setting up ingestion of the InTrust repository contents.Engineer, Federal Government Read Case Study
The components installed by default are InTrust Deployment Manager, InTrust Server and InTrust Repository Viewer. If you customize the selection to install individual components, see the requirements for the components you need in the InTrust System Requirements document supplied in the product download. If you use the default selection, the combined requirements are as follows:Architecture
Min. 4 cores (for example, for evaluation purposes).
For any real-world uses, at least 8 cores are recommended.
Min. 4GB (for example, for evaluation purposes).
For any real-world uses, at least 8GB are recommended.*
If you deploy InTrust on a virtual machine, make sure the CPU and memory requirements above are met, and do not overload the virtual machine host.