Creating Centralized Reporting for Microsoft Host Protection Technologies:The Enhanced Mitigation Experience Toolkit (EMET)

Abstract

Host protection strategies, such as enabling anti-exploitation features, can be effective in protecting Windows endpoints from compromise. Microsoft offers a tool to assist in this area and is provided at no cost. The Enhanced Mitigation Experience Toolkit (EMET) is a utility that helps to prevent the exploitation of software vulnerabilities. EMET can be effective in safeguarding organizations from compromise by malicious actors. The configuration of EMET can be controlled centrally by enterprise system administrators using Group Policy. While centralized management capability is built into the tool, centralized reporting capabilities are not, creating a challenge when it comes to real-time situational awareness, metrics gathering, troubleshooting, and reporting. This report presents methods by which systems administrators and/or information security personnel can create a centralized reporting console using native Windows capabilities and the Splunk machine data analysis engine.

Open PDF

Document Details

Document Type
Technical Report
Publication Date
Aug 11, 2016
Accession Number
AD1045014

Entities

People

  • Craig Lewis
  • Joseph Tammariello

Organizations

  • Carnegie Mellon University

Tags

Communities of Interest

  • Cyber
  • Engineered Resilient Systems

DTIC Thesaurus Topics

  • Computer Networks
  • Computers
  • Deployment
  • Detection
  • Engineering
  • Information Security
  • Information Systems
  • Networks
  • Operating Systems
  • Security
  • Security Personnel
  • Situational Awareness
  • Social Engineering
  • Software Development

Fields of Study

  • Computer science

Readers

  • Cybersecurity.
  • Database Systems and Applications
  • Distributed Systems and Data Platform Development