In this video, we get to take a big picture look at the wonderful world of
events inside of the 40 Analyzer.
And to start off, I'd like to chat about on the 40 Analyzer what an event is
not.
Because it's sometimes confusing when the same word is used and not in the
right context or we're
not aware of the context and it means something different. So as far as a 48
firewall, we're looking
right here at firewall one and I've gone down here under log and reports to
security events.
And then I've clicked on logs here. So the raw log events here on this 48, if WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then I've clicked on logs here. So the raw log events here on this 48, if
we go to the category,
for example, we have antivirus, web filter, DNS queries, etc, etc, etc. And
currently I have web
filter selected. I'm currently looking at the local memories here on this 48.
Now this 48 has
been sending all of its log information over to the 40 Analyzer. So we think of
events on the local
48 firewall, if you go in as the local events that are happening, but these are
just the event
logs here that we're looking at that are being sent over to the 40 Analyzer.
Because over on the 40
Analyzer, an event means something a little bit different. So here on the 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Analyzer, an event means something a little bit different. So here on the 40
Analyzer, and under
instance events, we go down here to event monitor, this is showing us a list of
events. And that's
for the last 30 minutes, so we go and change that to last, let's say three
weeks. And this from a
40 Analyzer perspective, under the instance events here is a representation of
events as shown here
at the 40 Analyzer. So where's the biggest difference between the word event at
the 48 itself with
this logs, and then an event over here at the 40 Analyzer. And so to help
really understand this,
let's go ahead and just imagine the workflow here. So let's imagine we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's go ahead and just imagine the workflow here. So let's imagine we have
some logging messages,
they could be event messages from the security events happening on the firewall
. And those are
all being sent over to the 40 Analyzer, along with traffic logs and security
logs and so forth.
And so those logs are being sent over include traffic logs, event logs, and
security logs.
However, once those get over to the 40 Analyzer, they're kept in a log format
initially,
and then they're put into the SQL database, we've taken a look at that in
previous sets of videos.
And then what happens in the brains in the back end of the 40 Analyzer is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then what happens in the brains in the back end of the 40 Analyzer is
taking all that information
that's received, all that logging information from all the devices are sending
in logs to the 40
Analyzer. And it's using something called an event handler. And one more thing
about an event
handler over here at the 40 Analyzer is think of it like the analogy of a
security guard who's
looking at all the mail and packages that come into a building. So if a
security guard is in the
mail room, for example, looking at all the incoming parcels and packages and
letters,
there's lots of different sizes and different people they're addressed to. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's lots of different sizes and different people they're addressed to. And
the security
guard has a set of rules. And in this analogy, one of the rules that the
security guard may have is
that if there are three letters from the same sender within five minutes, send
an alert, or if a
package arrives, it doesn't have a return address, or it's an oversized package
, it seems kind of heavy,
maybe a razor red flag and send an alert saying, Hey, you know what, there's a
possible problem
with this, it could be an issue. And so the security guard is then taking
action of some type based
on a set of rules. Well, that's very similar to what an event handler does
inside of a 40 Analyzer, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
inside of a 40 Analyzer,
based on the log messages that are coming in to the 40 Analyzer. So on the 40
Analyzer example,
could be we can have an event handler that's looking for five failed login
attempts within one
minute, and that raising the red flag, the result of that, if that was the rule
, that raising the
red flag is in the form of creating an event. And because the 40 Analyzer is
receiving logs from
all types of different devices, also it has its own logs for, you know, login
attempts locally as
well, those rules could be set up for failed login attempts to any of our 40
gates that are being WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
gates that are being
managed, or it could be rules regarding failed login attempts at the 40 Analy
zer itself. Here's
another example of a rule, let's imagine that with all the logs being sent in,
the firewalls identify
that this PC right here is reaching out to a command and control network we're
attempting to,
as well as attempting to do it to other malicious websites. So those can be
correlated based on
the event handler rules, and as a result, it could once again create an event.
So when we think of
events over at the 40 Analyzer, think of it as a set of rules that were matched
by an event handler
that created an event to allow us to know that that event occurred. And then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that created an event to allow us to know that that event occurred. And then
there's actually one
step further as well, we can also based on that event being created, we can
also have the event
handler actually create a new incident as well. And we'll have a separate skill
regarding instance,
but for now just realized that an instant thing like a case file or a ticket
that we can use then
to further analyze and work on a potential compromise or network. So a ticket
could include
multiple events as a collection for further analysis, and we'll have a whole WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
multiple events as a collection for further analysis, and we'll have a whole
separate skill
on creating and working with instance. But for now, I just want to be aware of
the workflow where
logs bring sent to 40 Analyzer, they're inserted into the SQL database, an
event handler looking at
all those log messages with a set of rules, we then go ahead and create events.
And then further,
we can take those events, create incidents for further analysis and
investigation and tracking
of potential problems in our network. But for now, we're going to focus on the
creation and
working with events and the event handlers, which make that all possible. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
working with events and the event handlers, which make that all possible.