4

I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with host name XYZ, I start investigating and I see that this IP is now showing Host name BFU. Because 10.10.10.4 has been assigned to a new user by DHCP.

What I see as a solution is that I should correlate the end user logs with DHCP logs to monitor / investigate the malicious attack at a certain period.

Can some one assist me here, how to go about it? If there is any other solution I'd love to know about it.

  • This will never work in a guaranteed way without something like 802.1X. IP addresses can be changed, MAC addresses can be changed, hostnames can be changed, and with a MITM attack a complete host/port/connection takeover can be done, even with 802.1X, and you'll never know who it was. – John Keates Jan 20 '17 at 17:50
0

Some SIEM tools give you the ability to run scripts immediately upon alert creation, therefore you could do an nslookup real-time as the alert fired and store the host name in the SIEM.

Some SIEM tools also have an asset management feature that tries to keep track of this information for you.

Otherwise you can manually search in the SIEM by filtering on that source ip during the hour or so before and after the event and look for other events around that time that may indicate the host name such as Windows authentication that have a source workstation field , or antivirus logs that have a hostname field or dhcp lease logs as you indicated.

Or if your analysts are working alerts real-time , then nslookup the ip immediately as the alert comes in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.