Next-Generation SIEM Solution

1. TheEasiest
Solutionfor
Next-GenerationSIEM
SureLog
International
Edition
www.anetusa.net

2. ANET
SURELOG
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

3. 3
SureLog
Next-GenerationSIEM
ANETSURELOGMAINADVANTAGES
*Forensiccapabilities
*Correlationengine
*Performance
*MachineLearning
*DashboardsIncidentresponse
*ComplianceReporting
*ScalabilityLogcompatibility
*Taxonomymodule
*ThreatIntelligence
*Themoresophisticatedcorrelationenginethantheothercompetitive
products.
*Advancedrules
*Visualruleeditor
*Creatingrulesfromthedynamiclists
*Updatingthegloballistsdynamically
*Rulesuspending
*Timebasedrules
*Automaticactionstoatriggeredcorrelatedevent
*BigData
*Distributedarchitecture
Theproducts
Scalability:
SureLogcanscaleintoanyorganization—bigorsmall,locallybasedoroperating
globally.ANETSureLog“HierarchicalMaster-SlaveModel”manageeventsinadistrib-
utedmannerforoffloadingtheprocessingrequirementsofthelogmanagement
systemfortaskssuchascollecting,filtering,normalization,aggregation.
Thismodelalsoissolutionforsecurityrelatedissuesandincrementalapproach.
Themainadvantageof“HierarchicalMaster-SlaveModel”iseasilyextendableand
scalablebyaddingregionalSIEMimplementations.
Logcompatibility:
SIEMfunctionsbasednotjustonitscorrelationrulesbutonthedatayoufeedit.
FeedingyourSIEMsecurity-relateddataresultsinmoreaccuratealerts.
Ifthereisalogformatthatisnotsupported,thereisanAPIforcustomlogparser.
SureLoghasnearly500+supporteddevice.
Dashboards:
Real-Timemonitoringanddashboardspermitsvisibilityatthedesiredlevelvia
security-based,pre-definedandcustomizableanalysis.
Inaddition,youcancreaterealtimeandeasyreportsbypreparingdashboardsand
widgetswhichareappropriateforyournewadhocrequirements.
TheSureLogapplicationfeaturesdashboardsonvarioussecuritytopics.
Dashboardsdelivermonitoringandreportingmetricstotrackthestateofsecurity
throughoutthenetwork.
Thesearesimpletoconfigureanduserfriendly,whileallowinguserstoreada
summaryofexistingnetworkinfrastructuredatausinggraphsandtables.
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

4. 4
SureLog
Next-GenerationSIEM
ThreatIntelligence
Threatsaredynamicandattackvectorschangeconstantly.
Respondquicklyandminimizedamagebyusingtherichexternalcontext
enabledbythreatintelligence.ImmediatelyknowaboutdangerousIPaddress-
es,files,processes,andotherrisksinyourenvironment.SureLogcombines
multiplethreatintelligencefeedsandgeneratesalertsforthebenefitofthe
securityteam.SureLogusesthisdatatoeducefalse-positives,detecthidden
threats,andprioritizeyourmostconcerningalarms.
ComplianceReporting
Regulatorycomplianceisnecessary.SIEMwillhelptosavetimeandensurecom-
pliancewithpredefinedreports.CreatingaproductiveSIEMenvironmentrequires
plentyofpredefinedreportsyouneedonadaily,weeklyormonthlybasisandalso
easytocreatereportinginfrastructureSureLoghasmorethan1400predefined
reportsandveryeasy&fastreportinginfrastructure.
Incidentresponse
IncidentresponseisanactionthatSIEMtakesinresponsetosuspiciousactivityor
anattack.ActiveresponseactionsincludetheBlockIPactiveresponse,theDisable
Networkingactiveresponse,theLogoffUseractiveresponse,theKillProcess
activeresponseandsoon.SureLogalsosupportstoexecuteanyexecutablefileasa
responsewithparametersfromdetectionrules
MachineLearning
MachinelearninginSIEMtakescybersecurityrulesanddatatohelpfacilitatesecurity
analytics.Asaresult,itcanreducetheeffortortimespentonrotetasksoreven
moresophisticatedduties.Withtherightconfigurations,machinelearningcanactual-
lymakedecisionsbasedonthedataitreceivesandchangeitsbehavioraccordingly.
SureLoghasmanyMLmodels.SomeoftheMLmodelsusedbySureLog.
·Detectingtoolsusedbycybercriminals
·Huntingcriticalprocessmasquerade
·Huntingmalwareandvirusesbydetectingrandomstrings
·Domaingenerationalgorithm(DGA)detection
·Profilinguserandentitybehaviour
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

5. 5
SureLog
Next-GenerationSIEM
Performance
TheperformanceanalysesofSIEMproductsareveryimportantintermsofevaluation.
TherunningperformanceofSIEMproducts,theresourceswhichtheyrequire(CPU,RAM,DISK)andhowtheywillshowperformanceintheEPSvalueneededisvery
important.
SureLoghasthebestSIEMperformanceespeciallyCPU,RAM,andDiskperformance
Forensiccapabilities
Almosteverycompanyneedsasolutionforprotectingitssensitivedataanddetectingsuspiciousactivityinrealtime.Besides,whenanincidentoccurs,companies
wanttobeabletoprovidedigitalevidenceinthecourtroom.Integrityalsocritical.Thisisusuallyachievedbyusingintegritymechanisms,suchasrunninghashchecks
onblocksofstoredlogdata.Historicallogdatamustbesecuredeitherwithachecksumintheformofapopularhash—MD5,SHA1,SHA2,etc.—orwithadigital
signature.Easilyaggregateandsearchlogswithinasingleplatformiscritical.SureLogcompressesindexes.CompressingindexesgiveSureLogtheadvantageoflive
search,real-timesearchcapabilityforyears.AnexampleofaSureLogdiskcapacityrequirementofalivesearchfor5000EPSforoneyearis5GB.SureLoglivesearch
diskusageperformanceisthebestamongcompetitors.WhenSureLogdiskusageforlivesearchcomparestoElasticsearchandLucenebasedsystems,theresult
depictedinthebelowgraph.ItisshownthatSureLogcompressmuchmorethanElasticsearchandLucene.
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

6. CORRELATION
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

7. 7
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
SureLog
Next-GenerationSIEM
SIEMusecasesorrulesarethe%80ofthevalueoftheproduct.ANext-GenSIEMcorrelationenginewillbeveryhelpfultoanalystsindeed.
NotallSIEMcorrelationrules,usecasesarecreatedequalanditishardtofindaSIEMthatsupportsbothcore,advancedandintelligentusecasesatanaffordable
price.AlltheSIEMproductshavecorrelationbutnotallSIEMsolutionsarecreatedequal.Detailedanalysisrequiredtounderstandthedifferenceofcorrelationcapabili-
ties.Forexample,mostoftheSIEMsolutionshavewatchlistorlistmanagementfeature,butSureLoghasmultidimensionallistmanagementcapabilityincorrelation.
Correlationanddetectionmethodsandcorrelationfeaturesdiversityareimportantlikedetectingwhatneverseenbeforeandmanyothers.
SureLogcanplayahugeroleinmakinganalysts’jobseasierwithmanymoderndetectionandcorrelationfeatureslikeneverseenbeforetypeofrules
SureLogSIEMruletypeexamples:
·Neverseentypeofrules
·Trendrules
·UBArules
·Anomalydetectionrules
·Changecomparisonrules
·Listmanagement
·Taxonomyrules
SampledistinguishingusecasessupportedbySureLog:
•Returnsdayswhereauseraccessedmorethanhis95thpercentilenumberofassets
•LookforauserwhoseHTTPtoDNSprotocolratiois%300morethan%95oftheotherusersforthelastfour-weekratiofor4thdayofweek
•Ifausernumberoffailedauthenticationratiotonumberofsuccessfulauthenticationis%10,alert
•Datalossdetectionbymonitoringallendpointsforanabnormalvolumeofdataegress
•Measuresthesimilaritybetweenwell-knownprocessnameswiththerunningonesusingLevenshteindistanceinreal-timeanddetectprocessmasquerade
•DGAdetection
•Failedlogontoanassetthatauserhaspreviouslyneverloggedonto
•Firsttimeuserisperforminganactivityfromacountry
•FirstVPNconnectionfromadeviceforauser
•FirstconnectionfromasourceIP
•Firstaccesstoadeviceforauser
•FirstaccesstodatabaseMSSQLforpeergroupHR
•FirstaccesstodatabaseMSSQLforuser
•Firstmailto/fromadomainfortheorganization
•Firstaccesstothiswebdomainwhichhasbeenidentifiedasriskybyareputationfeed
•Firstexecutionofaprocessonahost
•Firstaccesstoobjectfdghsdydhas
•Firstaccessfromahosttoadatabaseforauser
•FirstaccessfromsourcezoneAtlantaofficetoadatabaseforauser
•Suspicioustemporaryaccountactivity
•Abnormalaccountadministration
•Unusualaccountprivilegeescalation
•Unusualfilemodifications
•Abnormalpasswordactivity

8. SURELOG
SIEMAND
ADVANCED
THREAT
DETECTION
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010

9. 9
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
0100000111110001010101010001000010001000010001001101010101010101010101010101010010000100100001000000000101001101001000100010000100101000100010000100100101001000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
0101010101010101000100010100100101010101010100001001101011110001001000100001011110010010001000100100010001000100101100101010101010100001010010101001000101001001010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
1000100100100001000101010101010100100101011111000000100010001010101010101010101010100101011111101010101010100001001010101010101010101010101010101010001000100101010001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
SureLogSIEMcomeswithadvancedcorrelationengine,behavioralanalytics
andMachineLearning(ML)modelstoautomatepatterndiscoverywhile
facilitatingintelligentrulecreation.
AsasubfieldofArtificialIntelligence(AI),SureLog’sMLusesalgorithmsto
findpatternsindataandmodelsthemtodetectanomalousbehaviorofusers
andentities.SureLog’smachinelearninglibrary,pre-packagedwithover1,000
modelsandcorrelationrules,enablesorganizationstobetteridentifyadvanced
persistentthreats(APTs)thathavepreviouslybeenflyingundertheradar.
SureLogSIEMFederatedAnomalyDetectionEngineUsing
Classification
NextgenerationdetectionengineofSureLogSIEMcombiningrulebasedand
MachineLearning(ML)basedtechniques.SureLogutilizesmachinelearning
modelsandadvancedcorrelationrulestogetheranddynamicallyupdateeach
ofthem.
AnomalydetectionwithSureLoginfersaprobabilisticmodelforthenetwork
behaviorsofeachIPaddress.Eachnetworkeventisassignedanestimated
probability(henceforth,theevent’s“score”).Thoseeventswiththelower
scoresareflaggedas“suspicious”forfurtheranalysis.
SureLogutilizesLinearDiscriminantAnalysis(LDA)asclassifier.
UserandEntityProfilingwithSureLog
Organizationsneedtoguardagainstnotonlyoutsidercybercriminalsbut
alsorogueinsiders.Toeffectivelydealwithinsiderthreats,alayeredsecurity
approachleveragingbothpreventiveanddetectivesecuritycontrolsshould
beinplace.SureLogfocusesoninsiderthreats,suchasemployeeswhohave
alreadybeencompromisedormaliciousemployeeswhohavegonecorruptand
carryouttargetedattacks.
DomainGenerationAlgorithm(DGA)DetectioninSureLog
DNSisprobablythebestsourceofdatafordetectinganattacker’scommandand
controlactivity,whichcanbeisolatedbylookingatoutboundDNSrequests.
Botnetsplayanimportantroleinmalwaredistributionandtheyarewidelyusedfor
spreadingmaliciousactivitiesintheInternet.
Identifyingalgorithmicallygenerateddomainsinnetworktrafficisakeyaspectfor
analyzing,detectingandmitigatingbotnetbehavior
HuntingCriticalProcessMasqueradeUsingSureLogSIEM
Apopulartechniqueforhidingmalwarerunningonoperatingsystemsistogiveita
namethat’sconfusinglysimilartoalegitimateoperatingsystemprocess,preferably
onethatisalwayspresentonallsystems.Processeswhosenamesareconfusinglysim-
ilartothoseofcriticalsystemprocessesarelikelytobemalicious.Maliciousprocess
detectionusingprocessnameiscritical.
SureLog
Next-GenerationSIEM

10. 10
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
HuntingMalwareandVirusesbyDetectingRandomStrings
UsingSureLogSIEM
TherearemalwaretoolsavailablethatcancreateWindowsserviceswith
randomservicenamesanddescriptions.Emotetinfectionisanexampleof
maliciousservicescreatedonthemachine.ThisisduetohowEmotetinstalls
itselfonamachine,creatingrandomlynamednumericservices,whichinturn
trytorunanotherrandomlynamedexecutablein“C:Windows”Theexample
belowshowsfourEmotetservices(othermayhavemore)thathavebeen
createdonaninfectedmachine.
Figure1.MaliciousService
DETECTINGTOP4TOOLSUSEDBYCYBERCRIMINALS
RECENTLYWITHSURELOG
CyberCriminalsareusingvariousmalicioustoolsforcyber-attacksbasedonthe
target’sstrengthtoinfiltratethesensitivedataandmoreoftennowadaysPublicly
AvailableHackingToolsaremainlyusedbythreatactorsforvariousattacksaround
theworld.Herewecanseethemostusedtop4publiclyavailablehackingtoolsby
threatactors:
*ChinaChopper
*Mimikatz
*PowerShellEmpire
*HUCPacketTransmitter
Thosetoolsarewell-knowntypeof
*Webshells
*CredentialStealers
*Lateralmovementframeworks
*Commandandcontrol(C2C)obfuscators
LargeScaleSureLogSIEMImplementation
Today’scomputernetworksproduceahugeamountofsecuritylogdata.Thesecurity
eventcorrelationscalabilityhasbecomeamajorconcernforsecurityanalystsand
ITadministratorswhenconsideringcomplexITinfrastructuresthatneedtohandle
hugeamountofsecuritylogdata.ThecurrentcorrelationcapabilitiesofSecurity
InformationandEventManagement(SIEM),basedonasinglenodeincentralized
servers,haveprovedtobeinsufficienttoprocesslargeeventstreams.
SureLog
Next-GenerationSIEM