Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [siem]

The tag has no usage guidance.

1
vote
0answers
19 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
0answers
31 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
1
vote
1answer
74 views

Fortigate Creating Millions of DNS events to standard domains

I am trying to tune our SIEM and noticed that we are receiving millions of DNS records every day from the same domains. These are: update.microsoft.com swscan.apple.com softwareupdate.vmware.com ...
1
vote
1answer
81 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
0
votes
1answer
30 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
1
vote
1answer
73 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
3
votes
2answers
197 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
-1
votes
1answer
142 views

What is the future of SIEM tools? [closed]

Do SIEM tools have a future or will everything move to 100% automation? Will an analyst need to monitor and analyse the collected data in the future or will this be automated? How will SIEMs tools be ...
0
votes
1answer
271 views

How to detect webshell [closed]

I implemented an SIEM and right now looking for solutions to detect webshell upload to IIS and Apache web servers. What are the requirement for detecting webshell upload?
2
votes
4answers
302 views

SOC and generic log parsing

I am making a conceptual work-flow of a SOC so if we suppose that a SIEM solution is integrated inside an organization's in-house SOC. Also, if the team of the SOC is the one managing the SIEM ...
1
vote
0answers
212 views

How can XML External Entity attacks be detected?

XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
0
votes
2answers
6k views

What is the difference between a SIEM and a SOC?

What is the difference between a SIEM (Security Information and Event Management) and a SOC (Security Operations Centre)? Do they work together? And if independent when to use which?
0
votes
3answers
158 views

What is the difference between Compliance and Auditing in Information Security?

I am a student working on my semester project and it's about developing a SIEM solution with Big Data tools to be used in a SOC (security operations centre) and I know that collecting logs can be used ...
1
vote
0answers
45 views

Machine reaching out to Microsoft IP address using NBTstat command

I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address. Should UDP 137 ever reach out externally? This is about all the ...
-3
votes
1answer
339 views

What architecture for a SIEM based on an ELK cluster? [closed]

First thoughts to build a SIEM based on ELK, inside a multi-locations company : All assets send their log to Logstash locally (for each location) ElasticSearch stores the logs locally after Logstash ...
1
vote
0answers
433 views

Does an ELK based SIEM need a correlation engine? [closed]

We want to build a SIEM with an ELK stack, for a multi sites software company (10 locations, 10k people). Is a security specific correlation engine recommended or is it unnecessary? As possible ...
1
vote
2answers
223 views

SIEM and Security Analytics

I've encountered the two terms 'SIEM' and 'Security Analytics' a lot in the past few weeks, unfortunately I still don't understand the difference. According to some research I've done about these ...
0
votes
0answers
589 views

Event ID 4625 without source ip

I am working on a SIEM implementation but I have a problem with windows Event ID 4625 that is related to login fail. I can get login fail's log but the source ip is empty. how can I solve the problem?...
1
vote
0answers
109 views

Splunk integration with HoneyD [closed]

In a previous thread someone mentioned about HoneyD causing logs to fill up too fast, there was a comment posted about using splunk. I am very interested in how to integrate HoneyD with Splunk, it ...
7
votes
2answers
1k views

How do I track bash history cleanup?

I'd like to catch events when bash history is cleaned or some lines are deleted. Are there any best practices or auditing tools with this capability?
3
votes
2answers
444 views

Incident Responders: Can you give some examples of Incidents / types of incidents that are suitable for fully or partly automated response? [closed]

You setup security monitoring - either a full commercial SIEM/SOC or something home-cooked (e.g., rsyslog -> OSSIM / MozDef / Splunk / ...). You also setup some rules so that some event triage is ...
2
votes
1answer
617 views

SIEM Alien Vault recommended method for muting noise

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that ...
0
votes
1answer
105 views

Do SIEM appliances perform similar tasks to non-commercial anti-malware software? [closed]

First of all, let me apologise if this is considered an ignorant question. I'm new to the concept of SIEM and have been asked by my new employer to familiarise myself with the subject. I understand ...
1
vote
0answers
55 views

Would extracting logs from a European server to a US SIEM system cause privacy legal concerns?

Looking for an answer related to the European "General Data Protection Regulation." laws.
4
votes
0answers
355 views

SIEM: Monitoring End Users and DHCP IP assigning issue

I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with ...
0
votes
1answer
942 views

Difference between audit log failure/success?

I am working on event logs. I receive different logs such as 1. Success audit 2. Failure audit For same type of events(Login,logoff) etc. What exactly is the difference between these two types of ...
0
votes
1answer
186 views

Do we need to include SIEM hosted in the cloud in CDE scope for PCI DSS requirement..? where no CD or transacation logs are being process or managed

We have our cardholder data environment (CDE) hosted in on-premise model (private datacenter), except SIEM solution is implemented for logging and monitoring in private cloud. where we are forwarding ...
2
votes
2answers
367 views

Detect a Host on my Network that is Conducting Web Scraping on External Systems

It recently came to my attention (through an outside company) that a host on my internal LAN may be conducting web scraping activity against that outside company's web servers. Due to this activity, ...
0
votes
1answer
231 views

Attack from different blacklisted IP which belongs to different GEO location [closed]

Attack from different blacklisted IP which belongs to different GEO location although source MAC address is same. Why?
0
votes
1answer
604 views

Are SIEM and NIDS/HIDS complementary?

I just would like to have your feedback if you were involved with Security Information and Event Management. From your experience, do we have to add a SIEM to an existing NIDS (snort) and HIDS (ossec)...
2
votes
1answer
200 views

Dealing with “trojan” ports

We have a SOC which "monitors" our network activity, it basically collects all logs from all our firewalls and creates reports. We have a huge network with hundreds of servers and upto 2000 users, ...
1
vote
0answers
288 views

How to create alerts for Watchgurd firewall in SIEM

I'm working in a SOC (Security Operation Center) where we use a WatchGuard firewall in our customer's environment. We currently create alerts for other devices (SonicWall,Cisco ASA) based on event ...
0
votes
1answer
270 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
0
votes
1answer
402 views

Physical Access Control Logging on a SIEM - Is it worthwhile?

The company I work for (Manufacturing) are upgrading their Physical Access Control (PAC) System, and it will come with logging that can be fed into the our SIEM tool(LogRhythm). Does anyone have any ...
-2
votes
1answer
455 views

Telnet alert on SIEM

We are currently setting up the McAfee SIEM. Some rules have been set up using signature ID. Below is the alarm that triggers frequently: Summary: Signature ID 'Suspicious - Remote Shell ...
1
vote
1answer
1k views

Callback Detectors: Connection to High Confidence C&C Server IP Detected

We are in the process of tuning McAfee ESM. Below is the log- Source IP = 173.224.123.242 Destination IP = Internal IP (always the same) Source Port = 443 Destination Port = 3740 (2502, 2442, 1208, ...
0
votes
1answer
718 views

I can't connect to OSSIM server [closed]

I installed OSSIM in VMware workstation.The installation was successful.But when I entered the login and the password I have this message " incorrect login" I know that la login must be "root". ...
2
votes
2answers
441 views

Choosing between SSH and HTTPS for executing script using McAfee ESM Nitro

We intend to use McAfee ESM Nitro (SIEM) for security monitoring of our infrastructure servers. To bring automation in system administration of our servers, we have developed some applications in-...
1
vote
1answer
715 views

How to test DOS attacks through Router?

One of my clients has been told by their ISP that a DoS attack has happened and they have provided the logs of Juniper router. What is the criteria in routers on which we can confirm DoS attack is ...
1
vote
2answers
2k views

How to find why so many host are talking to an IP which is blacklisted

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall. I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host name:...
2
votes
3answers
655 views

Gathering network device data for security detection purposes

I've finally gotten the networking team to start sharing data on the devices they manage (routers, firewalls, VPN, NAC, etc), so we can get better insight into our network and focus more on detection. ...
5
votes
3answers
4k views

SIEM Question: Excessive Firewall Denies / Rule Edit Question

We have a SIEM in our environment that we're currently tuning and part of that process is reducing the noise in our console. One offense I've been working on is: Excessive Firewall Denies Between ...
4
votes
3answers
17k views

ELK Stack as a SIEM - First steps

I have experience with a couple of commercial SIEM solutions running on Security Operation Centers. I've been reading about companies using Splunk as SIEM. I'm a big fan of open source solutions and I ...
2
votes
3answers
5k views

How to detect port scan on SIEM within LAN or same Network?

Let's suppose a host machine in the client environment has been infected and its performing port scanning on other machine within the LAN or same Network without passing through Firewall: On what ...
3
votes
1answer
316 views

Event codes for Unix [closed]

I have to write alerts in SIEM Tool. Do we have any events code for Unix as we have in Windows. If yes, where can I find that? If not, on what basis can we write alerts for unix flavours or machines?...
1
vote
0answers
459 views

Virtual Pentesting Lab on popular Enterprise level UTM and SIEM

I’m planning to add a new Penetration Testing Segment to my personal “Pen Lab”. It’ll be centered around Vulnerability Assessments /Penetration Testing on market leading Next-Gen Enterprise SIEM,UTM,...
-1
votes
1answer
563 views

Recommendations for installing OSSIM

I'm an apprentice in web security and I was assigned with the task of researching about OSSIM. Bear with my infinite ignorance as I take my questions to the stack exchange gurus. What I know so far: ...
2
votes
2answers
2k views

Log information for SIEM auditing in Linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
1
vote
2answers
1k views

Best practices when classifying log messages severity in an SIEM

When deploying an SIEM solution, what is the best practice when classifying the severity of each event that is being sent from individual devices? I understand that this may be a little bit ...
0
votes
1answer
784 views

SIEM v/s Network Forensic

when SIEM is already implemented in a enterprise network; does it not do all tasks and report like network forensic investigation? Or can we do away with SIEM and have only Network Forensic tools ...