Build a readable security-event view from reliable sources
Event Manager is the Core Security security-event-management enquiry within the Fortra portfolio. Start with the incidents and reporting questions the organisation needs to support, then select relevant event sources. Normalised records are useful only when identity, timestamps and asset context remain accurate enough for review.
Inventory critical systems and the people who own their logs. Distinguish the ability to collect an event from the ability to detect a meaningful scenario. A connected source that lacks the necessary fields should remain a known quality gap rather than being counted as complete detection coverage.
Accept the path from source to responsible reviewer
Confirm current source support, deployment requirements and licence terms. Prioritise a manageable set of use cases and establish collection access through the customer's approved process. A pilot should trace known events into the selected rule, report or analyst view, including a case that requires another team to act.
Set retention, reviewer permissions and processing arrangements according to the customer's approved requirements. Test loss of a source and incorrect time or identity context where practical. Handover should contain source and detection registers, exceptions and escalation instructions. A platform installation does not imply continuous staffing, incident-response authority or a fixed resolution commitment; those are separate service arrangements. Reporting should make unsupported or excluded assets visible to the customer.
Evidence to request for this scope
- Validate source compatibility and the fields needed for each initial security use case.
- Trace authorised test events through collection, interpretation and notification.
- Document retention, source-loss reporting and customer authority for any response action.