System log

System events are logged by Windows and Windows system services, and are classified as error, warning, or information. It is sort of a catchall category where many interesting artifacts can be found.

One such category is the Group Policy service, which is responsible for applying Group Policy to computers and users. By default, the service starts during computer startup and remains operating until computer shutdown. Errors occurring within the core service usually result in a failure of Group Policy processing. Management of domain computers permits administrators to heighten the security and regulation of those machines with Group Policy. Because of the potential broad impact from rules related to the Group Policy, an administrator should investigate those events immediately.

Kernel power event errors often occur when the computer is shut down, or it restarts unexpectedly. Malware is known to cause these conditions. When a computer that is running Windows starts, a check is performed to determine whether the computer was shut down cleanly. If the computer was not shut down cleanly, a Kernel Power Event message is generated.

It is also important that a system should be kept up to date to mitigate known vulnerabilities. Although unlikely, these patches may sometimes fail to apply. Failure to update issues should be addressed to avoid prolonging the existence of an application issue or vulnerability in the operating system or an application. As such, this makes for a useful event for Helix Enterprise to look for and generate an alert on.

Finally, the service control manager (SCM) is started at system boot. It is a remote procedure call (RPC) server, so that service configuration and service control programs can manipulate services on remote machines. Because of the large range of Windows events that the SCM can generate, it is a very useful module as a building block in behavioral rules.