Differences between the Authentication - Suspicious Authentication report and the Malicious Code report in SEM

10/9/2018 3:12 PM

6/3/2019 1:47 PM

This article briefly goes over the differences between the Authentication - Suspicious Authentication  report and the Malicious Code report in Security Event Manager (formerly Log & Event Manager).

Security Event Manager

Authentication - Suspicious Authentication report:

This report extracts all the AuthSuspicious alerts which have been sent to SEM. These events include excessive failed authentication or authorization attempts, suspicious access to unauthenticated users and suspicious access to unauthorized services or information. These depend on the events that the device in question is sending to SEM. If a windows server for example sends event logs to SEM to do with unauthorized users attempting to log in multiple times, then this would fall under the suspicious authentication report.

See Events in the SEM Administrator Guide. Here you will find a list of events that would fall under this category.

Malicious Code report:

The Malicious Code report concentrates on a more narrow field, strictly just for any events that are related to malicious attack attempts. For example, a Windows machine with antivirus sends event logs to SEM in relation to virus like behavior, or other malicious activity.

See Events in the SEM Administrator Guide. Here you will find a list of events that would fall under this category.

With Suspicious Authentication reports, you typically have more events related to suspicious activity included in the report, while the Malicious Code report contains attack related activity in the logs that arrive to SEM.