Importing and Auditing Event Log Archive Files

The Event Log File Import Feature enables SAs and ISSMs to load previously archived Event Log Files into the Corner Bowl Server Manager Primary Log Database. This feature is typically used by auditors each week to systematically audit air gapped systems, that contain CUI and classified data, from an external location.

In this Topic

• Video Tutorial
• To Import Event Log Files
• To Audit Event Log Files
• To Reset the System

Video Tutorial

To Import Event Log Files

• From the Menu Bar select File | Import Event Log Backup Files. The Import Event Log Backup Files View displays.
• Use the Select File button to select multiple Event Log Files (.evtx) or multiple zip files that contain Event Log Files.
• Use the Select Folder button to select a folder that contains Event Log Files (.evtx) and/or multiple zip files that contain Event Log Files.

• Use the Specify the computer the logs were generated from check box to manually specify the name of the host the Event Log Files were generated on, otherwise the hostname from the first Event Log Entry is applied. Typically this value is the host's FQDN. If you do not want hosts imported using their FQDN, use the text box to specify the actual host name instead.

• Use the Remove previously downloaded or imported entries check box to delete or drop each table before importing each unique host and log type.
• Use the Filter drop-down to select an import filter.
• Click Import to start the import process.

Batch Importing Multiple Event Log Files

To Audit Event Log Files

Once your Event Log Files have been imported, the next step is to assign your compliance Reports to the newly imported hosts.

• Create a Report group, then assign the Reports and/or Sub-Report Groups you want to apply to the hosts being audited.
• Assign your new Report Group to the root Hosts Node.
• Once assigned, to your hosts, right click on any Report then select View Report.

Assign NIST/JSIG Reports to All Hosts

To Reset the System

When auditing a batch of different stand-alones or networked systems, best practices are to reset the databases and target hosts between each audit. Once reset, each audit is then limited to the current batch of Event Log Files.

For more information see: System Reset.

Related Topics

CUI and Classified Data Specification

Reports