intrusion detection

[Shayne D. Swann]

Does anyone know of a tool that I can use to monitor the Security logs for
event ID 681's? I currently use event combmt to periododiclly monitor the
event logs for event ID 681,s. But this is some what ineffective for
proactivily monitoring for brut force attacks. We do not use MOM here (we
are too cheap). Is there a tool that I can use to report if X number of 681
per minute are flagged on a domain controller it will generate an email to
the domain admins?

 

[Simon Geary]

Log Parser can query the DCs for specified event IDs but I'm not sure about
the email sending part though, worth a look anyway. If it doesn't have a
built in email capability you could maybe script it using blat.

http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx