Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.

share|improve this question

closed as too broad by Steve Sether, Neil Smithline, John Deters, Mark, Deer Hunter Dec 24 '15 at 11:04

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Luis - It is really hard to answer a question about what is "most relevant" without really understanding your threat model. The answers will be different if you are most concerned about insiders, nation state attacks, trojans, etc. – Neil Smithline Dec 24 '15 at 1:53
    
@NeilSmithline this question is almost 4 years old, I'm not sure the OP is going to respond – schroeder Dec 24 '15 at 4:59
    
Guess not @schroeder. Didn't notice when it came up for a close vote – Neil Smithline Dec 24 '15 at 5:02

You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat.

It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than others. Some of them might contain a lot of "normal behavior". The thing is that some things only become relevant after analyzing over a longer period of time. You might notice one attacker is doing his best extra hard to get in. You might get a hacked server and then you'd have to be able to go back and look for related security events to learn from the incident.

share|improve this answer

It depends on source of logs! If logs source is windows then look for account logon failures, password reset or change attempt, deletion or creation of new account, conflict in hostnames. You can visit ultimatewindowssecurity where you can find critical events to look for.

In firewall logs you can check for port scan (one host ip visiting more than 100 destination ports in short time),FTP logins on SAP,Malware activity.

Check for high bandwidth consumption by any application or process.

In proxy logs check for SQL Injection,Data tempering, Search queries etc.

Use cases:

  1. Warn if 5 failed logon attempts are tried with different usernames from the same IP to the same machine in 15 minutes and after that, if a successful login occurs from the same IP to any machine.

  2. Warn if a host scan is made by an IP and then if a successful connection is established by the same IP and then backward connection is established from connected IP to connecting IP.

  3. Warn if more than 100 connections are established from the different external IPs to the same destination IP in one minute.
  4. Warn if 100 connections are established from the same external IP through different ports to the same destination IP in one minute.
  5. Warn if the same user tries more than three failed logon attempts to the same machine in an hour.
  6. Warn if a user can’t log into any server and caused failed authentication and in two hours if that user can’t log into the same server.
  7. Warn one if more than 100 packets are blocked by UTM/FireWall from the same source IP and don’t warn within an hour. (Millions of packets are blocked in case of DDOS attack. If email is sent for each, you are exposed yo yourself DDOS attack.)
  8. Report the source IP which causes UnusualUDPTraffic.
  9. Warn if a traffic is occurred to a source or from a source in IPReputation list.
  10. Warn if network traffic occurs from the source or to a source in malicious link list published by TRCERT - Turkey - Computer Emergency Response Team
  11. If someone sets up DHCP server in your network or if a different gateway broadcasts, to find out this: Warn if a traffic occurs from inside to outside or from outside to inside whose protocol is UDP, destination port is 67, and destination IP is not in registered IP list.
  12. Warn if an IP scan occurs.
  13. Warn if SQL attack occurs via web server.
  14. Warn if the servers are accessed out of hours.
  15. Warn if the same user tries more than three failed logon attempts to different machines in an minute.
  16. Warn If an attack followed by account change
  17. Warn If scan followed by an attack
  18. Detects An Unusual Condition Where A Source Has Authentication Failures At A Host But That Is Not Followed By A Successful Authentication At The Same Host Within 2 Hours
  19. Look for a new account being created followed by immediate authentication activity from that same account would detect the backdoor account creation followed by the account being used to telnet back into the system
  20. Monitor same source having excessive logon failures at distinct hosts,
  21. Check whether the source of an attack was previously the destination of an attack (within 15 minutes)
  22. Check whether there are 5 events from host firewalls with severity 4 or greater in 10 minutes between the same source and destination IP
  23. Look for a new account being created, followed shortly by access/authentication failure activity from the same account
  24. Monitor system access outside of business hours
share|improve this answer
    
Your link does not talk about windows events. Is there a subpage somewhere? – schroeder Dec 22 '15 at 16:12
    
The whole website is useful. Yes but for the windows event here is the link ultimatewindowssecurity.com/securitylog/encyclopedia/… – Jigar Lad Dec 23 '15 at 18:45
    
The link you provided does not do what you say it does. It is a list of all eventIDs and not a list of important ones, which is what the OP is looking for. Is there a list of Windows eventIDs that are critical to security? You list some, but there are far more. – schroeder Dec 23 '15 at 19:23
    
Well Buddy look at the event and little bit shake your mind and come out with a combination of correlation. You wont get everything in one bowl – Jigar Lad Dec 23 '15 at 20:29
    
But "one bowl" is what the OP is asking for – schroeder Dec 23 '15 at 20:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.