Hot answers tagged

16

At a high-level, just remember that: A SIEM (Security Information and Event Management) is a specific kind of technology, providing network visibility in a security context (by indicating suspicious/illegitimate activity through set-up rules and correlation intelligence), and enabling security analysts to act on suspected threats. A SOC (Security Operations ...


9

Monitoring the Bash history is easily done with a shell script, but just checking it for unexpected changes might not be an effective security measure but rather clutter your logs with false-positives. One obvious way to monitor file system events associated with your .bash_history file would be by using the inotify API. E.g., this triggers on file ...


7

A Security Information and Event Management (SIEM), is a tool that collects and normalises logs which are tested against a set of correlation rules that when triggered creates events for human analysts to analyse. A Security Operations centre (SOC) is a centralised unit of security analysts (and related job roles) that deal with security issues, using a ...


6

Usually it'll be the other way around, a scanner will have a list of known CVEs and how to test for them. It will then give you a filtered version of that list based on which vunerabilities apply to the system under test.


4

Verify that the reported host runs a legitimate application on the port. For example, port 8080tcp is the default alternative port for HTTP. It is used by many legitimate applications. Look up what the destination host is supposed to be running in your configuration management database (you do have a CMDB, do you?). When it is supposed to run, for example,...


4

I have some doubts about integrating syslog-ng with ELK. Is that really necessary? Of course not, syslog-ng is a "log management infrastructure." If you deploy ELK as a SIEM you can manage all your logs there. You just need to install an agent on each server you want logs from. You can use the official logstash client or any other tool that parses your ...


4

Just by capturing the full traffic the task does not magically gets less complex. The traffic still needs to be processed and the information extracted. In contrary, capturing all traffic inside a huge network and processing it in real-time is a huge task: there is lots of bandwidth needed to collect all traffic in the first place and huge processing power ...


4

It is not a threat per se, but can be an indication of something unexpected. For example, HTTPS runs on port 443. If someone starts a rogue HTTPS server on port 10443, for example, it could be used for data exfiltration. Or it could be a development environment running there, with insecure settings. It is not expected to run HTTPS on port 10443, so finding ...


3

This looks like a QRadar rule. It would be good to ask the question on the IBM developer forums as you will have more QRadar administrator eyes on it. That being said, firewall denies are inevitable if you have a DMZ. The flaw is that many people look at just firewall denies, but do not look at firewall permits. Denies are only affirming what you hope to ...


3

This data comes in handy when (if) you'd have to perform incident response. Consider the following scenario: "Employee John Doe has logged into a system at HO and immediately after data is erased." Your SIEM should be able to detail what occurred: date: 06/30/16 11:45EST username jdoe MAC ADDR 00:00:00:00:00:0a HOST IP 192.168.1.100 ACCESSED -> This ...


3

Looks like someone is probably trying to brute force usernames/passwords or other malicious connections to your host. Either way you should never have telnet open because it is very insecure. You need to disable port 23 immediately on your host.


3

This will entirely depend on what your goal is. Generally you need to classify the severity based on the threat of business continuity. First of all categorize per type and subcategorize: Security Events => external, internal Availability => hardware ( disk arrays, batteries going bad, chassis open...), software (Is the http service still available, what is ...


3

Of the top of my head I wouldn’t say anything. The point of a SoC/SIEM is to bring things to the attention of a human analyst in order to evaluate the incident and decide on what actions to do next. Anything you don’t want a human to get “eyes on” should be tuned out of the SIEMs rule set. There might be certain low risk things you want to automate, for ...


3

Active responses such as dropping and ignoring requests are the only kind of automated response I've engaged in. Any commercial IPS or Web Application Firewall does this. HIDS/HIPS can be considered too, for extremely small deployments. Simple WAF rules might block the attacker for a limited time if: If the User-Agent is wget or curl or similar ...


3

I'm assuming that you want to detect when people have entered some kind of private information into their shell and are now trying to remove it from the bash history. From an attacker point of view it would be easy to simply constantly create copies of the .bash_history file and check for entries being removed. If you are doing this to prevent accidental ...


3

The way this was explained to me at a very basic level is the following: Auditing refers to seeing who did what, when where, this could include systems and people. You'll probably hear the terms "audit logs" which refers to a series of logs that indicate who worked on a system, when and what they did. Compliance refers to ticking (or not) a series of ...


3

Some, non-exhaustive reasons a legit server might operate on a non-standard port: A development instance that nobody should connect to by accident. A low-privileged app that can't listen on ports below 1024 A second server of a type that already is running on the same host (e.g. you could have a "normal" web server on 80/443, and another one that ...


2

Auditing is broad term and could mean auditing that the SIEM is working as expected or generating reports providing detailed usage statistics. (It could mean many other things beyond these as well) The SIEM will only be as good as the data source, so that is the first thing you should check. Ensure you have a number of defined use cases, for example low ...


2

"Let's suppose a host machine in the client environment has been infected and its performing port scanning on other machine within the LAN or same Network without passing through Firewall:" Typically, if a host within your environment gets infected, it's not going to be port scanning other devices on your LAN. At least in my experience. It's typically going ...


2

Every connection within your LAN must go through a router or switch. Some routers allow access control lists, which can block/allow connections to specific ports and services. Each host may also implement internal firewall rules to only broadcast a service to specific hosts, this however, means more management and operational overhead. Another option is to ...


2

Do we have any Events code for Unix as we have in Windows. nope. what you have is a bunch of software that writes logfiles, but these logfiles do not follow any standard. If Not, On what basis can we write alerts for unix flavours or machines . for Auditing,application or network based alerts. network-based attacks are usually detected by a NIDS like ...


2

When starting an SEIM project, a step-wise approach to security events management is a good approach EG inventory and prioritize your infrastructure, and rate each device according to its security impact/exposure. For example, you will get more detailed security event information from a firewall than from a router. Likewise with web access logs, OS level ...


2

@Florin Coada has one good explanation. I like to think of it as this: Compliance deals with the state of things. Auditing deals with actions taken on things. Compliance looks ahead, auditing looks back. Let's say that there is a security issue - a terminated employee's account is not deleted in time and is accessed. Data is leaked. Compliance would ...


2

When speaking of Compliance and Auditing one always has to define the respective scope. A system, a process or a control can't just be compliant. It always is compliant with something. To quote from Wikipedia: Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure that they are aware of and take steps to ...


2

Does SIEM has future Yes. like is it going 100% automation No. like an Analyst need to monitor and analyse? Yes, but hopefully less than they do today. Or how the SIEM tools will be in future? More automated analysis, but still reliant on humans to discriminate between false and true positives.


2

Here is some links that may help you: https://vizsec.org/data/ http://www.fukuda-lab.org/mawilab/data.html https://mcfp.felk.cvut.cz/publicDatasets/ On the other hand, consider datasets from 1999 is not going to be very useful unless you are testing the stability of your system, but for detection/classification I don't think will help from my point of ...


2

Here is a curated list https://www.secrepo.com/ It contains data sets for various security attacks, threat feeds, machine learning, network and more. Hope this helps.


2

I think you just have a wrong perception of what your SIEM does/is supposed to do, or how it operates. The SIEM most likely raises alerts on installation attempts of "bad software" via the OS' audit logs or similar methods. Since personal laptops are no company-managed clients, they most likely do not submit those audit logs to the SIEM, or communicate in ...


1

As part of the Security Center GA announcement MS introduced the preview of a log integration connector for SIEM integration. I haven't tried it out myself yet, but I imagine this will be the new recommended solution for your request.


1

The cardholder data environment (CDE) is limited to the network segments storing, processing, transmitting cardholder data. Your in-scope system components are beyond this CDE as systems providing security or other services are in scope for validation - i.e. authentication, update/patch management, orchestration, anti-virus, logging, FIM. So this means your ...


Only top voted, non community-wiki answers of a minimum length are eligible