Introduction toSecurity Event ManagerMegan McGuireChristophe BriguetVisibility & Controlon IT Security

Collect

Log CollectorLogsSEM appliance

Normalise

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=assessment.impact.severity=source.node.nameOrIp=source.service.nameOrPort=target.node.nameOrIp=target.service.nameOrPort=target.user.nameOrId=Extract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=assessment.impact.severity=source.node.nameOrIp=source.service.nameOrPort=target.node.nameOrIp=10.10.0.3target.service.nameOrPort=target.user.nameOrId=Extract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=assessment.impact.severity=source.node.nameOrIp=source.service.nameOrPort=target.node.nameOrIp=10.10.0.3target.service.nameOrPort=sshtarget.user.nameOrId=Extract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=SSH Remote user login failedassessment.impact.severity=highsource.node.nameOrIp=source.service.nameOrPort=target.node.nameOrIp=10.10.0.3target.service.nameOrPort=sshtarget.user.nameOrId=Extract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=SSH Remote user login failedassessment.impact.severity=highsource.node.nameOrIp=source.service.nameOrPort=target.node.nameOrIp=10.10.0.3target.service.nameOrPort=sshtarget.user.nameOrId=johnExtract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=SSH Remote user login failedassessment.impact.severity=highsource.node.nameOrIp=209.195.132.165source.service.nameOrPort=target.node.nameOrIp=10.10.0.3target.service.nameOrPort=sshtarget.user.nameOrId=johnExtract of a IDMEF event

Map Logs to a Structured Event Format10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 classification.text=SSH Remote user login failedassessment.impact.severity=highsource.node.nameOrIp=209.195.132.165source.service.nameOrPort=5735target.node.nameOrIp=10.10.0.3target.service.nameOrPort=sshtarget.user.nameOrId=johnExtract of a IDMEF event

Classify Events with a Taxonomy10.10.0.3 sshd[76195]: Failed password for John from 209.195.132.165 port 5735 SystemAuthenticationRightUseConfigurationAttack……FailedUpdateAccount…

Enrich

Add Context Information to EventsSLASiteContactEventHostRegulationMain IT AssetsSEM Asset DatabaseOrganisation

Correlate

UseCase #1: Vulnerabilities correlation« The SEM knows that the target is vulnerable and the attack succeded »« The SEM knows that the target of the attack is NOT vulnerable »

UseCase #2: Asset Database correlation« Assets have been misused or bypassed (i.e. email sent directly to Internet or web browsing from the mail server) »« Connection to an IP located in a country under US embargoes (i.e. Iran, Korea, etc.) »

UseCase #3: User auth. correlation« Bruteforce attack = many logon failed + 1 success »

UseCase #3: User auth. correlation« Login failure alert correlated with target criticality »Medium severity event for the WinDC serverLow severity event the WKS-1 workstation

Escalade

An Incident Case is a Data ContainerIncident Case : A Data Container for Remediation ActionContact (owner)Business costTime costEvents and AlertsImpact on CIARemediation action

Two-Ways Interaction with Trouble Ticketing SystemIncident CaseExternal Trouble Ticketing SystemAlerts

Report

RegulationsSOX, HIPAA, FSA, etc.Standards and FrameworkCOBIT, ISO 27001, PCI-DSS, etc.Reports allow to:Establish controlsMaintain controlsProve controlsControls

Establish controls

Maintain controls

Prove controls

Dashboard OverviewDashboardReportWorkspaceChartEvents detailText session (comments)

Reports Drill Down1243

EscaladeEnrichReportCorrelateNormaliseCollectBenefits are …

Sorting out normal vs. abnormal

Achieve regulatory compliance requirements

Fill the gap between technologies and process

“TitleWant to see SEM in action? Ask for a Demo!”