Why NetWrix is #1 for Change Auditing

NetWrix Approach to Change Auditing

Quadrant of Auditing Solutions

Change auditing is an essential component to IT security of an organization. There are a few different approaches to change auditing, and all of them have certain shortcomings, resulting in not sufficiently high level of auditing consistency or decreased system reliability. That's why NetWrix has invented a new AuditAssurance™ technology to help you control IT infrastructure changes in the most effective way.

NetWrix AuditAssurance™ technology is a patent pending technology that is used in NetWrix Change Reporter family products. NetWrix approach to change auditing allows to significantly reduce the risk of auditing failures and give you a complete and clear picture of what's going on in your environment, meeting two important requirements simultaneously: auditing consistency and system reliability, as illustrated by the diagram on the right.

Native auditing lacks many important features that are critical to meeting security requirements and doesn't have any reporting capabilities. Careful analysis of user-unfriendly, difficult to understand audit logs containing excessive amounts of log 'noise' can take enormous resources and still never paint the complete picture. NetWrix technology allows to capture detailed information on all changes, including "before" and "after" values for every modification, and generates clear audit records, which can be used by IT professionals and auditors for detailed forensic analysis.

Intrusive heavyweight technologies of custom auditing require the injection of proprietary data collection software agents into operating system mechanisms, which can lead to decreased stability and reliability. AuditAssurance™ technology offers optional non-intrusive agents specifically to provide network traffic compression and filter data, saving precious bandwidth, and they do not modify or tamper core operating system functions, providing high level of system reliability.

Traditional SIEM (Security Information and Event Management) solutions rely only on a single source of audit trail data, which is generated by system itself or custom software agents and sometimes may not contain all the required data (e.g. because it has been erased, overwritten, or otherwise tampered with). In this case SIEM solution can't provide the necessary level of auditing consistency. Alternatively, AuditAssurance™ technology consolidates the audit data from multiple independent sources (event logs, configuration snapshots, change history records, etc.), and therefore is able to detect a change even if one or more of the sources does not contain all the required data. NetWrix technology also allows integration with traditional SIEM systems.