symantec endpoint protection manager login failed

In SAP Security Configuration and Deployment, 2009 Daily Tasks Ensure logging is implemented, but make sure it does not cause more harm than good. Situations may exist where so much logging is done that it actually camouflages the attacker's efforts. Administrators should constantly be making adjustments to the logging system to reduce logging traffic that can be considered “white noise.” White noise is where too much is being logged and administrators cannot make heads or tails of all the data presented to them via the logging system. Lastly, implementing logging is not something that is done and forgotten about. Time stamping logs and using a synchronized time server on network hosts may allow administrators or forensic analysts to trace the attacker's steps back through the network to help identify the initial breach point. Logging and time stamping logs to a centralized server can help ensure logs are able to be viewed in the event an attacker attempts to clear the local system logs. System logs should be configured to log critical security events to centralized and redundant servers. When implementing a logging initiative, it is vital to ensure usability of the logging system and redundancy. Reducing the active attack window is vital to helping preserve the stability and integrity of the network. Logging once properly configured and implemented can also help an organization by reducing the reaction time from when an attack begins and when an administrator is notified and can deploy countermeasures.

Logging is an important part of security that allows administrators to be notified of potentially dangerous attack against its network and assets.

Many times, organizations do not spend enough time implementing detective controls as it applies to tracking access and logon violations. In Scenario 3: Timed Attacks to Circumvent Lockouts, we explored an attack that should have caused a lot of logs to be generated due to failed logon attempts.

Alpern, in Seven Deadliest Microsoft Attacks, 2010 Logging Security Events

Symantec endpoint protection manager login failed