I will be hosting a webinar that presents Tenable's strategy for agentless auditing and reporting of various US Government standards including FDCC, USGCB, CyberScope and a variety of DISA STIG specifications. The webinar will include:

• Nessus configuration and vulnerability assessment capabilities 
• How to use the Passive Vulnerability Scanner to perform continuous monitoring 
• Performing enterprise configuration audits for FDCC, USGCB and a variety of DISA STIG policies 
• Working with XCCDF FDCC content and generating an FDCC report 
• Creating CyberScope reports based on active or passive discovery of vulnerabilities and applications 

The webinar will last approximately 40 minutes followed by a question and answer section. To register, visit the following gotomeeting link: 

• https://www1.gotomeeting.com/register/694506168

I'll also be showing some of the new reporting and dashboard capabilites of SecurityCenter 4.2 which enables several different approaches to configuration auditing, continuous monitoring and Cyberscope reporting.  

When a virus infected one of my Nessus scan targets, I did what any sensible CEO of a SIEM company would do - let it run and see what types of logs and alerts it generated!

Over the 30 days that I let it run, I was able to collect a wide variety of interesting data. This included suspicious Windows application logs, internal network scans, communication anomalies, attempts to break into other lab computers and "classic" outbound connections  to various IRC channels. It even modified how logins worked, breaking my Nessus patch audits. 

Attendees of this webinar will learn about various detection methods that can be used with SIEMs to look for malicious software and computers infected with hostile code. 

Putting a Virus under the SIEM Microscope
Wednesday, January 26 2:00 PM EST
https://www1.gotomeeting.com/register/178513273

During the months of November and December, Tenable CEO Ron Gula will be running four webinars focused on advanced analysis of network traffic, system logs and user tracking. Please visit the registration page for each of these to sign up. 

Passive Realtime Web Server Monitoring
November 22, 2010 1:00 PM EST
https://www1.gotomeeting.com/register/649650513 

Continuous User Activity Monitoring
December 1, 2010 1:00 PM EST
https://www1.gotomeeting.com/register/651487424

Tracking Application Execution for Compliance and Security 
December 13, 2010 1:00 PM EST
https://www1.gotomeeting.com/register/280241224

Monitoring Users and Botnets with DNS
December 15, 2010 1:00 PM EST
https://www1.gotomeeting.com/register/435011097

These webinars will demonstrate many different approaches to monitoring networks and users by gathering system logs and network activity. Tenable's Unified Security Monitoring set of solutions will be used to highlight technologies such as: 

• passive logging of DNS queries
• associating log data to user IDs
• analyzing Unix and Windows process execution logs
• tracking insider file sharing over SMB, HTTP and FTP
• tracking malicious code from download, to infection to spreading  
• passive discovery of Internet activity and social networking usage
• turning process execution and DNS query logs into actionable events

If you would like to learn more about Tenable's set of logging, passive monitoring and user tracking products, please feel free to visit our web site, watch our demonstration videos or contact our sales staff. 

Version 4.4 of the Nessus Vulnerability Scanner features: 

• Scan scheduling
• Improved reporting
• Reduced memory usage
• Plugin reloading and configuration changes during scans 

Please join Tenable Network Security CEO Ron Gula to learn about these new features and to participate in a live question and answer session.

Title: Nessus 4.4 Introduction Webinar
Date: November 17th, 1:00 PM EST
Register: https://www1.gotomeeting.com/register/477600664