Accession Number:

AD1045014

Title:

Creating Centralized Reporting for Microsoft Host Protection Technologies:The Enhanced Mitigation Experience Toolkit (EMET)

Descriptive Note:

Technical Report

Corporate Author:

CARNEGIE-MELLON UNIV PITTSBURGH PA PITTSBURGH United States

Personal Author(s):

Report Date:

2016-08-11

Pagination or Media Count:

19.0

Abstract:

Host protection strategies, such as enabling anti-exploitation features, can be effective in protecting Windows endpoints from compromise. Microsoft offers a tool to assist in this area and is provided at no cost. The Enhanced Mitigation Experience Toolkit EMET is a utility that helps to prevent the exploitation of software vulnerabilities. EMET can be effective in safeguarding organizations from compromise by malicious actors. The configuration of EMET can be controlled centrally by enterprise system administrators using Group Policy. While centralized management capability is built into the tool, centralized reporting capabilities are not, creating a challenge when it comes to real-time situational awareness, metrics gathering, troubleshooting, and reporting. This report presents methods by which systems administrators andor information security personnel can create a centralized reporting console using native Windows capabilities and the Splunk machine data analysis engine.

Subject Categories:

  • Computer Systems Management and Standards

Distribution Statement:

APPROVED FOR PUBLIC RELEASE