Yep. Try Axent's ITA- Intruder alert. This features realtime detection based on rules defined (also predefined rules available) by the administrator. As far as I know this is the only product available that allows a user to create both passive and active policies. It is also multiplatform, and all agents can be controlled from a central box..on unix or NT. regards Nhan Confused when awake. adamsb@un.org wrote: > I have worked on half a dozen different networks over the past six > years and the two most effective intrusions I saw were through > out-of-the-box Windows NT installations with dial-up modems. > > Recently I ran my own command files to check the security on 12 > newly installed NT boxes and every one of them had most of it security > > turned off. This looks like it is going to be a continuing problem. > > Does anyone have any experience with a Windows NT based real-time > intrusion detection system that is commercially available? > > Hog Farmer, > formerly with > Tropical Hog Improvement Programme