Today we are storing security events in a repository. We then have a search set up each night to grab logon info for the previous day. This has been working for a couple of years, and gives us the info we need. However, the only option is to store this in a CSV/PDF, which doesn't give us a lot of options for storage or enhancing the report. Currently we pull user ID information out of the report and query AD for more information on said user. A manual process that we want to automate. In addition, we'd like to utilize PowerBI to build reports off of this information. Having a CSV works, but not for a nightly report since the file name changes on each report.
I started looking at using the InTrust Manager for a gathering rule that would write to the database. I wouldn't necessarily need the data to stay there if I could get what I want from the table as I know over time this database would get very large. However, I am not seeing nearly the amount of data in the table from the gathering rule that I see when the same events are stored in the repository. So on the surface this doesn't seem to be a good option.
Is there a way to write the Repository Viewer search data to a SQL table?
Do the gathering policies in InTrust Manager collect less detailed information that what is stored in the repositories for Security events? If the answer is "No", then I must not be doing something correctly with the gathering policy.
I am VERY new to this InTrust product, so I am not positive I am doing everything correctly. I know there is an SRS option, and at this point we don't have it enabled. I don't know that it would help us for 2 reasons: 1) the lack of detail from the security events, and 2) the need to have Active Directory information added to our reports.
What we have today in our report from Repository Viewer:
Date, Type, Who, Computer, Logon Type, Where From
Type is "success audit", Who is user ID, where from is an IP address....all of this info comes from the event in the repository.
Hopefully this makes sense and someone knows if we have any options.
