security monitoring using siem null bangalore meet april 2015
TRANSCRIPT
Flow of the presentation
• What is Log file ?
• What is Event ?
• What is security monitoring?
• SIEM Architecture
What is Log file
What is Event ?
Each line in above log describes an event
What is Monitoring ?
What is Security Monitoring ?
What kind of rule we write in SIEM
• In SIEM we write correlation rules
• For e.g.: Suppose: X is Event 1Y is Event 2
Then we write rules like:
Rule 1: If X is generated after Y within 2 minutes then generate SIEM alert Z
Rule 2: If X is generated 10 times within 1 minutes then generate SIEM alert B
How we write a rule ?
We try to understand the pattern of different attacks and then try to convert it into rules
Different patterns of attacks
Gartner 2012, 2013, 2014 Magic Quadrant for SIEM Vendors
SIEM Architecture
Splunk Architecture
ArcSight Architecture
Alien Vault Architecture
Qradar Architecture
Elements which are normally present in almost every attack scenario
SIEM presents the complete detail of the attack scenario
