cfir homeri security presales - central eastern europe ......global event ids (geid) uniquely...
TRANSCRIPT
Cfir Homeri Security Presales - Central Eastern Europe & [email protected]
The New ArcSight Architecture
User Cloud App Servers & Workloads
Network Endpoints IoT Physical
ARCSIGHT ENTERPRISE SECURITY MANAGER24x7 Real-time Monitoring & Correlation
UEBAUser Entity Behavior Analytics
ARCSIGHT LOGGERCompliance | Search |Retention
ARCSIGHT INVESTIGATEHunt | Investigation
SECURITY OPEN DATA PLATFORM
MANAGEMENT CENTERSuite Management & Administration
TRANSFORMATION HUBInformation delivery
SMART/FLEX CONNECTORSData Collection, Enrichment, and Normalization
CONTENTUnified | Actionable | Insight
WEB CONSOLEAccessible Monitoring & Platform Management
ArcSight ESM 7.2
Release Summary
Release Name: ArcSight ESM 7.2.0
GA Date: December 4, 2019
Gen10 Appliance GA Date: January 10, 2020
Key Themes: [Simple, Intelligent, Open, Converged (Sentinel, Interset, ArcSight), etc]
Release Highlights / What’s New?
1. Global Event ID
2. Rules Action
3. AutoPass licensing support and Event Ingestion Metrics
4. MITRE ATT&CK Dashboard
5. Default content available on installation
Global Event ID
ESM 7.2 includes the new Global Event ID feature. SODP assigns a unique event ID to each security event being ingested and distributed. That ID will stick with the event as it moves to and through ArcSight Logger, ESM, and Investigate.
Benefits to the Customer : Global Event ID will help customers track unique security events across their entire ArcSight ecosystem. They can quickly search for and verify that a specific event is the one they are looking for. This helps facilitate threat investigation and cross-portfolio event analysis.
Global Event IDs (GEID) uniquely identify an event in ArcSight product suite. ESM event schema now includes Global Event Id field in addition to the Event Id field.
GEIDs are generated using a GEID generator id. Generator id is specified during fresh install/upgrade and should ideally stay the same for the lifetime of the
product.
The generator id must be unique for each ArcSight product (e.g. connectors/ESM/Logger etc.) in an ArcSight deployment.
Events received by ESM from external sources (connectors/TH) should have the GEIDs set by the external source. Only connector version starting 7.12 onwards supports GEID in events.
Events generated internally by ESM (correlation events, audit events, monitor events etc.) will have their GEIDs set by ESM.
7
Global Event IDs
GEIDs can be viewed in Active Channels, Filter, Query Viewers etc.
All places where Security Event fields can be viewed.
Note that if the event source (connectors/TH) do not send events with GEID set, ESM will not set them.
Events archived in previous versions of ESM, prior to upgrade, will not have GEIDs set in them upon reactivation.
8
Global Event IDWhere GEIDs can be viewed
Improve concurrency of deferred rules action execution
Capture the result of external scripts
9
Rules Action Improvement
Multiple threads to handle rules deferred actions
Actions within one rule will be executed in sequence
Configure number of threads to process rules deferred actions.
In server.properties, rules.action.threads
10
Rules Action -- Improve the Concurrency
We save the result of executing rules actions in action event. E.g. ExecuteCommand:Success
The following are fields used to save result in action event:
Device Custom Number 1: Return value
Device Custom Number 2: Execution time
Device String 5: Console output – When there is an error in execution. Limit to 200 characters
11
Rules Action -- Capture the result of external scripts
Return value error code:
0: Success
1000: Invalid platform
1001: Exception in executing the script
Other value: Returned by script
If a script returns a non-zero value(error), there will be console output in device custom string 5.
12
Rules Action -- Capture the result of external scripts
13
Sample SlideIf you are seeking additional funding outside of the annual Portfolio Operation Planning process, state specifics
How many additional persons?
<provide count>
Other funding needs
<provide details>
Business Justification
Describe why this is necessary and should be considered while providing evidence of data to support request
What is scheduled rules?
Query historical events
Run at a specified time interval (hourly, daily, weekly)
Scheduled rules engine is a batch rules engine which filters historical events, generates correlation events and execute rules actions like real-time rules engine
14
Scheduled Rules
With the new licensing model, ESM generates a 45-day median report every day at 23:59:59 UTC
ESM maintains a history of average EPS, SEPS, MMEPS and license capacity.
The history of license usage is maintained in mysql database table arc_epd_stats.
15
45 – day EPS median report
EPD – Events Per Day is the total number of events generated in a twenty-four hour clock period.
SEPS – Sustained EPS is the “constant” Events Per Second that the system sustained within the twenty-four hour clock period. The formula used for this calculation is (EPD/((60*60)*24))
MMEPS – Utilizing the SEPS information recorded per day, the Moving Median value is calculated using a 45 day data set, and shifting the calculation window one day every twenty-four hours after the first 45 days.
Median is calculated by sorting SEPS over a 45 day range and taking the middle one or avg of middle two values (when even number of SEPS available).
16
Calculations
For days 1..45, there isn't enough SEPS collected yet to compute the MMEPS, so we display "approximate" MMEPS
on day 2, this would be the SEPS for day 1
on day 3, this would be the average of SEPS for day 1 and 2
on day 4, this would be the median SEPS for days 1..3
and so on until day 46 where there will be 45 days of SEPS, and a real MMEPS could be computed.
To distinguish the "approx." MMEPS from real MMEPS, the former are shown in gray, while the latter are shown in green/yellow/red.
Reference: https://wiki.arst.hpeswlab.net:8443/display/DEV/45-day+Moving+Median+EPS+Report+on+ACC
17
MMEPS Calculation
Stats page - https://<esm_host>:8443/www/ui-phoenix/com.arcsight.phoenix.PhoenixLauncher/#eventStatistics
CLI tool – exports to a CSV file - bin/arcsight licenseusageexporter
18
Accessing the report
License Metrics
ESM New Content for 7.2
Overview
New Default Content
MISP Model Import Connector
Threat Intelligence Platform
Security Threat Monitoring
MITRE Tagging
Integration Command
Updates to Existing Content
21
Agenda
22
What is MITRE ATT&CK ?
MITRE ATT&CK™ is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
The MITRE ATT&CK™ includes 3 major components Matrices, Tactics Techniques
What:
Dashboard showing events that match the MITRE ATT&CK matrix.
Why:
Having content to tag MITRE ATT&CK use cases enables SOC to identify threats enterprise is facing.
Dashboard will provide visualization of threats identified in an intuitive way.
23
MITRE ATT&CK Dashboard
The Basics – The Pyramid of Pain
25
MITRE ATT&CK – Blueprint for Attack Tactic & Techniques
26
Visualization
Datasource
/All Active Lists/ArcSightFoundation/MITRE ATT&CK/Rules Triggered with Mitre ID
27
Details
MITRE ATT&CK Activity Dashboard with Drilldown
1) User selects “MITRE Activity” from the main dashboards2) Within the tree visualization, user selects a specific
technique.3) All real-time correlation rules related to that alert are
shown on the right, along with more MITRE-related information.
4) When clicked, a special channel opens up with *ONLY* those events related to the selected technique.
1 2
MITRE ATT&CK Activity DashboardA special visualization, showing a tree-view structure: MITRE ATT&CK tactics in the middle + techniques as the branches.
MITRE ATT&CK Activity Dashboard Drilldown Steps
1) User selects “MITRE Technique” from the main dashboard. E.g. “Brute Force”
2) All real-time correlation *rules* related to that alert are shown on the right, along with more MITRE-related information.
3) When clicked on a specific ‘rule’ (e.g. “Brute Force OS and Application Attempts”), a special channel opens up with *ONLY* those events related to that rule.
3
4
3
MITRE ATT&CK Activity Dashboard
MITRE ATT&CK Activity Dashboard with Drilldown
1) The special active channel opens up *ONLY* those special events related to the rule, associated with the chosen MITRE Technique: “Brute Force”
2) All other MITRE ATT&CK artifacts are displayed in the channel.
MITRE ATT&CK Activity Dashboard
MITRE ATT&CK Overview Dashboard
MITRE ATT&CK Matrix Overview Dashboard
MITRE ATT&CK-tagged correlated alerts/events and specific dashboards per MITRE Tactic and MITRE Technique ID are provided OOTB and as a downloadable MITRE ATT&CK Content Pack.
Content: MISP as a Threat Intelligence Feed
MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing, community driven platform
Has become invaluable platform for the NATO, Europian governments and CERTS
It is a threat intelligence platform for gathering, sharing, storing and correlating Indicators of Compromise of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counter-terrorism information.
34
What is MISP?
35
New Model Import Connector for MISP has been developed.
Threat Intelligence Feed from MISP can be directly imported into ESM using this new MIC.
The new Threat Intelligence Platform content utilizes this MISP data
MISP as a Threat Intelligence Feed for ArcSight
5 x ESM Active ListsAlways up-to-date through MISP CRCL Model Import Connector.
Suspicious Email List @ ArcSight ESM
Suspicious Domain List @ ArcSight ESM
Suspicious Filehashes @ ArcSight ESM
Suspicious Full URL List @ ArcSight ESM
37
Design Overview
2 new packages – Security Threat Monitoring and Threat Intelligence Platform
Content:Threat Intelligence Platform
40
Threat Intelligence Platform (TIP) package detects security threats based on data feed from MISP which is collected by MIC.
It is possible for customer to import the feed from other source into ESM with the same format of active list.
Intelligence feed from MISP
41
Use cases for Threat Intelligence PlatformGlobal
VariablesRules
42
Reputation Data Overview
Content:Security Threat Monitoring
44
Security Threat Monitoring package detect attacks based on security logs from firewall, IDS/IPS, OS, proxy, scanner etc.
Use Cases
Rules
Use Cases for Security Threat Monitoring
Resources :
2 active channels
2 Dashboards
13 Rules
7 Data Monitors
13 Filters
3 Fieldsets
45
Example - Entity Monitoring
The MITRE Framework for ArcSight ESM are a bunch of ArcSightresources which monitor MITRE ATT&CK rules and it includes the following end user resources:
2 Dashboards
1 Active Channel
1 Integration Command
1 Report
46
MITRE ATT&CK Framework for ArcSight ESM
The MITRE Technique is Mapped to ArcSight Rules
47
MITRE ATT&CK Framework for ArcSight ESM
48
Examples : MITRE ATT&CK Overview Dashboard
49
Examples : MITRE ATT&CK Targets Overview Dashboard
Brute force
Exploit of remote service
2 Integration Commands
50
Integration Commands
Logger 7.0
24 TB of Event storage per Logger
New Search UI
Search based of event occurred time
EPS Licensing
Reporting:
Data Science – Ability to use Python’s Data Science/Predictive analytics capabilities with Reporting
Reporting on ArcSight Investigate – Investigate’s Vertica database can be added as a data source in Logger Reporting, allowing to create reports on Investigate Data.
IP to GeoMapping – Ability to convert IP address to Geo Location and create maps within Reports.
Out of the Box Content updates
Bonding/Trunking of NICs for Appliances
Gen 10
Peer search and reporting perf improvements (Internal Test Metrics Available!!!)52
Whats New
Why?
Need to collect more data, from more sources and retain in for more time.
Adding more Loggers is one solution.
Adding more storage to a logger is another solution.
53
24 TB of Storage
54
24 TB of Storage - Storage Group, Storage Volume
24 TB in Storage Volume.
12 TB for Default Storage Group and 5GB for Internal
Event Grid
Drag and Drop Columns
Resizable columns
Three types Events results Grid
Grid View
Raw Event View
Column View
Event Details
Hide/show null field values
Expand/collapse field categories
Event Comparison
Query Syntax Highlight
Open Filter and Saved Search
Field set selector55
UI Improvements – Search
56
New Search UI - Query with Syntax Highlight
57
New Search UI - Grid View
58
New Search UI - Grid + Raw Event View
59
New Search UI - Raw Event View
60
New Search UI - Event Details
61
New Search UI - Compare Events
62
Logger Gen 10 (Tentative GA – Jan 4th 2020)
DL 360 Gen 10 L7700 Spec
2 x Xeon-G 5118
2 x 12 core = 24 cores
12 x 16 GB = 192 GB RAM
10 GB NIC
2 port Ethernet
2 port SFP
4 x 10TB SAS 7.2K LFF = 40TB HDD
30 TB with RAID 5
24 TB of live Event Data
On Logger reporting, Python Data Science can be used to extract knowledge and gain insights form security data collected in Logger.
Python installed on OS (Redhat/CentOS) is used
Data Science Libraries included in Logger bits
scikit_learn, numpy, pandas, etc.
Turned off by default
Admin Guide Note to turn on Data Science
Python can be used for non data science aspects as well
63
Reporting – Data Science
Create Query object
MySQL / Logger search Query
Data Science Step
Python Script
Learning and predicting
Format/Other steps
Create Report
Grid
Chart
64
Data Science / Predictive Analytics
Data Science Engine component – while creating a reporting Query Object
Python Script of Data Science Engine component
Analyze firewall traffic based on port, and determine probability success for traffic to each port.
Compare future events to see if they conform to model. (i.e. if traffic on port 1234 is 90% fail, I need to pay attention to every success access attempt on that port)
66
Sample Data Science Usecase
67
Reporting on ArcSight Investigate
Configure Vertica
Create Query Object
Create Reports
Schedule
Publish
Export
Charts / Maps
Data Science
MaxMind Library is used for converting IP to Geo location.
Latest MaxMind is available with Logger 7.0
Context updates used by ESM will be used by Logger as well
Download Context update file from Entitlements portal
Logger Configuration -> Import Content
68
Reporting – IP to Geo
69
Report with IP to Geo – Recon Activity
Major rework of content after 4 years
100+ New Reports
Device Monitoring – OS, Anti-Virus, Networking, IDS-IPS, DGA, etc
Foundation – Intrusion, MITRE, Networking, Vulnerability, etc
OWASP
Cloud – CSA-Treacherous-12
8 New Dashboards
Malware Overview
DGA
MITRE
Attack and Suspicious Activity, etc.
70
Logger Out of the Box Content
71
OWASP\A 7 - Cross-Site Scripting\XXS Vulnerabilities(Top Events)
72
OWASP\A 2 - Broken Authentication\Broken Authentication Events (Signatures)
73
MITRE Events
74
MITRE - Radar Overview
75
DGA – Clients by Outgoing Bytes to DGA Domains
76
DGA Domains by Client IP Overview
Good for spotting DNS Tunneling only form the graph
77
DGA – Radar Overview
78
DGA Dashboard
