Enterprise Reporting Pack

The Enterprise Reporting Pack provides an enterprise class auditing and reporting module for the Privilege Guard solution.

The Privilege Guard Client logs events to the local application event log on each endpoint and these events are centrally collected using Microsoft Event Forwarding. Event Forwarding uses Windows Remote Management (WinRM) and enables events on remote computers to be forwarded to a central event collector server.

The Privilege Guard Event Collector software is installed on the event collector server(s) and it will automatically aggregate Privilege Guard events and upload them to the Privilege Guard Database on a SQL Server.

Enlarge screen shots

The Privilege Guard Reports are built on SQL Server Reporting Services and include a rich set of preconfigured dashboards and reports, which can be accessed from a web browser:

1. Executed Applications – reports on all applications that have been executed in the enterprise.
2. Elevated Applications – reports on all applications that have been executed with elevated rights in the enterprise, including a breakdown of those applications that were elevated automatically and those that were elevated “on-demand” through the shell extension.
3. Blocked Applications – reports on all blocked applications in the enterprise.
4. Discovery – reports on the applications in the enterprise that require admin rights to run, when privilege monitoring is enabled, and those that only require standard rights.

Each dashboard provides information on the top 10 applications, a breakdown of applications by publisher and an activity timeline. The timeframe for a dashboard can be switched between 24 hours, 7 days, 30 days and 12 months, to allow recent activity or trends to be displayed. You can drilldown on the graphs within each dashboard to view detailed application reports. Reports can further be filtered on event type, user, computer, application details and date ranges.