A<\/strong><\/p>\nThe SIEM solution helps in correlating and analyzing security events and identifying unusual or suspicious activity on an organization\u2019s IT infrastructure.<\/p>\n
It is a security log management system that collects log files, security alerts, and<\/span>\u00a0security<\/span>\u00a0events into one centralized\u00a0<\/span>location<\/span>, which enables security analysts\u00a0<\/span>and teams to efficiently analyze data.<\/span><\/p>\nQ<\/strong><\/p>\nWhat are some SIEM log sources?<\/p>\n
A<\/strong><\/p>\n1.\u00a0Firewall Logs \u2013<\/strong>\u00a0Firewall logs are a great source of detailed flow information. However, with many of the next generation firewalls, you also get rich data on application types, threats, malware, C2 and other similarly interesting things.<\/p>\nIt\u2019s important not to limit this data to just your perimeter firewalls. If you have firewalls between your user segment and your Data Center or even micro-segmentation inside the Data Center, send all of these logs to your SIEM. Where your end users are connecting is critical information from a threat analysis perspective. Internal visibility is key to looking for lateral movement.<\/p>\n
2.\u00a0Proxy\/Web Filtering Logs \u2013<\/strong>\u00a0Your NG Firewall may already include this data, but if you use a separate Proxy or Web Filtering solution, these logs should absolutely be sent to your SIEM too. The IP, Domain, and URL information is naturally very important and can give you information on connections to known-bad locations. And if you can also capture the User-Agent string, then you should. This can give the threat hunter lots of insight into what might be happening. There are countless stories about finding major breaches and issues by monitoring the various user-agent strings in an environment and investigating the anomalous or uncommon ones you find.<\/p>\n3.\u00a0Other Network Security Products \u2013<\/strong>\u00a0Some of these may already be covered with a next generation firewall, but you may have standalone systems in place. Logs from tools like Network IPS\/IDS, Network DLP, Sandboxes, and even router NetFlow data are all rich intelligence sources for the SOC analyst.<\/p>\n4.\u00a0Network Sensors \u2013<\/strong>\u00a0Many of our customers have network sensors that sit on TAP or SPAN ports and do Deep Packet Inspection on north\/south as well as east\/west traffic internally. These sensors will give deeper metadata around the traffic flows than a traditional NetFlow solution would. They can see things like SMB writes and deletes, HTTP header information and user-agent strings, and many other specifics. This additional detail is very interesting when looking for anomalous activity that could indicate things like lateral movement. These types of sensors can help you track down events that you wouldn\u2019t have seen otherwise.<\/p>\n5.\u00a0Windows Authentication and AD info \u2013<\/strong>\u00a0As we all know, users move around and often get new IPs. If this happens in the middle of a security event, it can be challenging trying to pick the trail back up and connect the dots. By tracking user authentication information, disparate record types across various IPs can be combined to paint a better picture of the entire activity around the event. In addition, tying a user to the events can help answer the questions around if this user should be accessing these resources. And it makes it easier to track that device down if needed for manual intervention or cleaning.<\/p>\n6.\u00a0Endpoint Security Solutions \u2013\u00a0<\/strong>Endpoint information is helpful on multiple fronts:<\/p>\n\n- Data from Endpoint solutions can help enrich the existing alerts by giving you inventory data like the OS, logged-in user, AD memberships, resource utilization and so on. As an example, you may not need to investigate an Oracle, Linux, or other IPS alert further if the endpoint doesn\u2019t run Oracle or isn\u2019t Linux. This can be a real time saver.<\/li>\n
- Alert data is also key info that should be sent to your SIEM. If the AV, endpoint firewall or other product alerted on something, it has often taken care of the initial threat; however, there may be additional threats still on the endpoint that weren\u2019t caught with the current signatures or rules. It\u2019s trivial for an attacker to modify existing malware to get by many of these protections. If anomalous activity is seen by another tool and there is a recent endpoint alert, this may be something you should investigate further versus closing out immediately.<\/li>\n<\/ul>\n
7.\u00a0Threat Intelligence \u2013\u00a0<\/strong>More and more, organizations are bringing threat intelligence into their SIEM solutions, which can help dramatically when investigating individual alerts. There are many free Threat Intelligence lists out there, so at a minimum bring a few of these data sources in. Even better would be subscribing to one of the many paid feeds out there. These paid feeds tend to be better maintained with better details and more accurate information. Threat Intel hits in your device logs could indicate malware that got past your endpoint solution or any number of other things that should be interesting to a SOC analyst.<\/p>\nhttps:\/\/www.sumologic.com\/blog\/blind-spots-in-your-siem\/<\/a><\/p>\nQ<\/strong><\/p>\nWhat is the purpose of\u00a0 Attack Simulation?<\/p>\n
A<\/strong><\/p>\n\n- Attack simulation helps a network defender recognize how the identified Indicator of Exposure (IoE) could become an exploit.<\/li>\n
- Run virtual penetration testing to uncover cyberattack scenarios. It can be done by simulating an attack that exploits vulnerable areas.<\/li>\n
- Breach and attack simulation (BAS) tools help run virtual penetration tests on the target organization<\/li>\n<\/ul>\n
![\"\"](\"\/wp-content\/uploads\/2020\/07\/threatmodelingtoolsandtechniques-1-300x187.png\")
<\/p>\n![\"\"](\"\/wp-content\/uploads\/2020\/07\/threatmodelingtoolsandtechniques1-1-300x224.png\")
<\/p>\n![\"\"](\"\/wp-content\/uploads\/2020\/07\/ISSTadardsandFrameworks-1-300x193.png\")
<\/p>\n