In this video I'd like to go ahead and walk you through the wonderful world
with some demonstrations
regarding events right here at the 40 Analyzer. So here at the 40 Analyzer is
currently receiving
input and logs from the branch firewall which is an HA pair. It looks like the
HA standby is
now running as well. Fantastic as well as the three firewalls at our
headquarters site and
that topology is represented right here as well. So there's firewall one,
firewall two, firewall three
and the branch firewall. So to see the events here at the 40 Analyzer we go to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the branch firewall. So to see the events here at the 40 Analyzer we go to
incidents and events
and then below incident and events we just click right here on the event
monitor. So currently
it's pulling from all devices including the 40 Analyzer itself and also I have
it set to show
the last three weeks of data. And currently we have all events selected but
there's also a tab for
buy endpoint which actually puts a filter in then we have buy threat again
putting a filter in for us.
We have one for system events again putting a filter in for that and then if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have one for system events again putting a filter in for that and then if we
don't want to
see some of those we can go to toggle views and we can select by endpoint
threat and system events
what we do or don't want to see just by selecting the checkbox or putting the
check back in to control
what shows up. So let's go back to all events and of course like most things on
the 40 Analyzer we
have the gear icon here to control which columns will show up and I'm going to
go ahead and set
this back to the default by clicking here on reset to default and then we'll
tweak it as we go.
Also whether the plus symbol it implies there's more to be seen below that so
if you want to expand
all of it there's an option here for expand all which simply expands all the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all of it there's an option here for expand all which simply expands all the
details you can also
do a collapse all or we can expand or collapse them as desired. Also for an
event we could go ahead
and let me open this one up system clock adjustment. If that's not important to
see we could also
right click on it. For this one here we may want to say suppress if you don't
need to see it you just
right click say suppress event click on okay. Now we're showing that that event
is suppressed and
effectively what that means is identical or similar events according to the
suppression
details that we just set up. And that can be used as a method to help reduce WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
details that we just set up. And that can be used as a method to help reduce
alert fatigue. For
example if thing keeps on coming up as an event and it's not a big deal by
suppressing it we're
then focusing more on items that need our attention. So right here we have trim
local database if we
right click on that once you read comments or assign it to an administrator or
suppress it or
we can view the logs or we can search in log v and what that'll do if we click
on that it'll open
up a new window for us in 40 analyzer and take us over to the log view. And so
it actually leaves
the original window open so we can go back to that and not lose our place. So
behind the scenes we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
behind the scenes we're
now looking at the actual log entry behind that event. So I'm going to close
that window and go
back to our original window with 40 analyzer. And of course here we can also
filter a couple
different ways we could click up here and start selecting and typing in our
filters or we could
right click and then here we say I don't want to see any medium events or even
better yet we could
I'm going to clear that filter. One of the better application might be take the
critical severity
and then from the drop down here go ahead and say filter by severity equals
critical and that
will just show us our critical. Or another way of doing that would be you know WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
will just show us our critical. Or another way of doing that would be you know
start typing out here
or severity and then we go and say equals and then three two one or zero. So we
could select zero
there and then click on search and that would effectively do the same thing. I
find it a lot easier
just to right click and do the filters that way but both options are available.
So I'm going to
clear the filters and now once again we're looking at all events. So with these
tabs by end point
that provides the security event views based on the end point perspective. So
here's all the end
points there. If we are looking at it by threat that's providing the event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
points there. If we are looking at it by threat that's providing the event
views from the threat
perspective and then what system events are showing us effectively the
perspective from the systems.
So log in log out failure here. What is this one? 40 analyzer. We bring it up a
little bit.
40 analyzer license limit exceeded. I think that's because I reboot that pretty
frequently and it
has the licenses and I'm not really exceeding it but it must be before I have
full network
connectivity and it can go out and validate its license. So that's kind of a
nothing burger here
in my lab environment but in a big environment where we have lots of stuff WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in my lab environment but in a big environment where we have lots of stuff
going on we'd want to sort
through identify what's happening and making sure that we don't have anything
critical going on
or at least if we do have something critical going on we want to be aware of it
so we can
address it and one of the first steps of doing that is right here in the event
monitor. I'm going to
have filter in place by right clicking on critical and then saying I want to
sort with a filter where
severity equals critical and then we can focus on our biggest challenges. Also
on the left here I'm
going to go ahead and collapse that columns we have a little more real estate
to work with and if
you want to put these upper tabs on the left hand side you can just use this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you want to put these upper tabs on the left hand side you can just use this
icon right here and if
you want to put them back you can just toggle horizontal menu and put them back
. So I'm also
going to go ahead and manage a few of my columns here as far as the first
occurrence and last update.
I'm going to go ahead and remove those as columns and none of these have been
suppressed so I'm going
to go ahead and just remove that as well and for additional info I'm going to
remove that as well
so that is right here I'll remove that and let's see how that looks. Actually
this one other column
I want to add it's not a default so I'm going to click on the gear and I want
to add detail. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to add detail. So
right here I have event details I'm going to add that as well and what that's
going to do
gives you a button to click on for more information so I can hover and I can
see the detail there I
can also click on it and it'll give me more details as well. So we have all
that at our fingertips
fantastic. So let's open up this one here 1030 0.103 and here we have two
entries for compromise host
detected and this right here is showing us the handler. So the handler is the
set of rules like
the security guard with a set of rules where if these things happen go ahead
and create an event
and so we had a handler called dark compromised host detection IOC by endpoint WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and so we had a handler called dark compromised host detection IOC by endpoint
another handler
called outbreak alert dark side ransomware detection and because these handlers
were in place by
default and because they recognize certain you know log messages coming in with
the various
indicators that's why they triggered effectively and created these events that
we're looking at
right here these two right here. Also the event handler applied tags to those
events so the first
one here was IP command and control and then for the second one here is malware
outbreak
CNC command and control and dark side. So each of these is a hyperlink as well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
CNC command and control and dark side. So each of these is a hyperlink as well
so if we click on
that handler it'll show us the details and effectively the rules regarding that
handler
why this event was created. So this is an example of a basic event handler and
a basic event handler
says that if any of these rules are matched then it's going to go ahead and
create the event. It's
also showing us based on the event that we're looking at the reason why it was
created so there's a
match on traffic to command and control network detected. So that's the rule
that was matched
and that's why this event exists because the handler rule is matched and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's why this event exists because the handler rule is matched and
created the event.
So we go ahead and cancel that and let's go ahead and grab the second one here
and click on
its handler and now it's showing us we're here in this handler why it triggered
and created the
event based on this rule matching right here the one in yellow. So for a basic
handler it's an
or condition any of the rules if they're met is going to go ahead and trigger
and cause the event
to be generated in 40 Analyzer and because we add the event details colony drag
that over here for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that over here for
each of those we could also click show details for more information including
the source IP,
source port, the threat name and more. We'll close that and we'll take a look
at the details for the
second one here again giving us event details so I'll close that. We can also
right click on one of
these events and there's two options here view logs which just simply shows us
the logs that the
40 Analyzer received that were part of the equation that triggered this event
to be made and we can
also do a search and log view. So if we click here on search and log view once
again it opens up a
new tab for us new window and showing us the individual log entries and then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
new tab for us new window and showing us the individual log entries and then
from here we can
right click and filter from here if we had a whole bunch or we could go ahead
and just double click
and that would give us the details for those individual log entries and I'm
going to close this tab
and go back to our original location in 40 Analyzer which is convenient because
we don't have to you
know find out where we were and go all the way back because this is a separate
tab it opened for us
and so we opened up this one this is regarding looks like some type of a SQL
injection or attempted
SQL injection so I'm gonna manage my columns one more time so there's a lot
here in this is my lab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here in this is my lab
environment and I created this in a production environment we definitely want
to investigate you
know what's happening we have a user which is what's happening here this user
is trying to implement
or trying to do SQL injection attacks to some outside resource meaning some
device on the internet
and then this user right here is trying to send traffic to a command and
control network very
likely that could be malware and the list goes on now if we have an event that
we've already dealt
with we want not to show up here on the event list what we could do is let's go
ahead and pick WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and pick
one of these let's go ahead and pick how about let me open up Linux client and
let me right click
on this traffic to botnet cnc dark side and what I could do is here say
acknowledge and acknowledgement
removes it from the event list if if click on okay if we say don't show
acknowledge so we click here
on show acknowledged it'll show up and if we remove the checkbox it won't show
up that helps us to
filter what we have to look at on this screen we could also add a column for
acknowledged as well
so if we click here on show acknowledged and then add a column for acknowledged WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so if we click here on show acknowledged and then add a column for acknowledged
so I'll go ahead and
do that right here there's also an option for who acknowledged it but for the
moment I just want
to show that it's acknowledged and showing these two right here that are now
acknowledged so if we
want to hide those we simply say don't show acknowledged and that is removed
now from our screen if we
have an administrator for example who's in charge of firewall three we could
take these events and
assign them to the firewall three administrator so let me open up the left
panel here i'll go to
system settings administrators so we have a branch admin but it's only in
charge of the
b-r-1-8 on which has no 40 gates in it so let's go ahead and create a new WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
b-r-1-8 on which has no 40 gates in it so let's go ahead and create a new
administrator firewall three
admin i'll add a photo we'll go ahead and drag and drop a photo there fantastic
it's uploading
click on okay so there's the image and as far as this administrator we'll give
them a password
we'll choose a profile and ideally we may want to have firewall three in its
own
administrative domain but for now let's be fine we'll click on okay so now we
have that
administrator we'll go back to incidents and events under event monitor and I
forget which
one we were looking at but let's just imagine this system right here we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one we were looking at but let's just imagine this system right here we can
right click on it
and assign two and then go ahead and assign it to firewall three admin and then
click on okay and
if you want to add a column for assigned we could so let's go ahead and do that
we'll click on the
gear and here's a column for assigned two we'll add that fantastic and that
shows up right here as
well and what we can do for firewall three or they can do it as well with the
permissions is we can
right click there and say search and then look for a filter saying exactly
assigned to firewall three
and then we could go ahead and save that as a custom view so let's go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we could go ahead and save that as a custom view so let's go ahead and
do that we'll click
right here on create custom view we'll call this assigned to fw3 admin and then
click on okay so now
well if we're looking at instant events here in the event monitor we can go to
the custom view and
here that view is ready to go and if we had multiple custom views usually the
drop down right here
to go ahead and select the custom view that you want to see for example let's
create one more
so go back to all events i'll clear the existing filter and let's make one
looking just for critical
so i'll right click and say filter by severity equals critical and i'll save WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so i'll right click and say filter by severity equals critical and i'll save
that as a custom
view as well so create custom view and click on okay and now under custom view
we have our two
custom views we have assigned to firewall three admin from the drop down and
then we have the
other one we just made we just call it critical and that can be really handy
for any views that use a
lot and don't want to have to recreate with filters every single time just
create them as part of a
custom view also remember if you go back to all events your last filter you
have in place is still
there so just be aware if you don't want to look at that or don't want that
filter click on the x
here to remove any existing filters so once again by creating our custom views WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here to remove any existing filters so once again by creating our custom views
we could
easily go back and forth with any views that we want to see the events that we
want based on the
filters now another element i want to share with you regarding events let me go
ahead and clear the
filters here you know in fact let's go back to custom view just tab here and
let's take a look at our
critical events fantastic here they are now currently all of these events are
unhandled now
what exactly does that mean effectively what it means is that this security
event these critical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event these critical
severity security events that we're looking at are open they haven't been
addressed yet so here in
the event status for all of these critical events there are four options one is
blank where it says
nothing there's an option called unhandled which we see here there's an option
called contained and
there's another option called mitigated so if we remove this filter when we
look at everything
you'll notice that we have a whole bunch that are unhandled we have some that
are mitigated and
some are blank and because i don't have it set up on my forte gates i don't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some are blank and because i don't have it set up on my forte gates i don't
have any yet that are
set up as contained so here's what it means unhandled means it hasn't been
addressed yet it hasn't
been mitigated or contained so it's considered effectively open if it's that
contained it would
mean that the risk is isolated for example if we had a quarantine action and we
've quarantined
that device that would show as a result here of contained if the firewall
blocked it or dropped
the traffic that would be showed up as mitigated which we see right here for
the antivirus where
the firewall dropped it we can also verify that by double clicking here so here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the firewall dropped it we can also verify that by double clicking here so here
's the log we'll
double click here and it's going to show us that indeed it was blocked and that
's what showing here
in the event status the status of mitigated where if we go to the web request
for malicious website
and double click there and then look at the log the action was passed through
it didn't stop it
and that's because of a security profile that was configured in this case on
purpose so i could
demonstrate about allowing some traffic through that probably shouldn't have
been allowed but it was
based on the profile and the action here was passed through and again that's
why it's showing up here
as an event status of unhandled and then for the ones where it's blank here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as an event status of unhandled and then for the ones where it's blank here
that's for other
scenarios so the three we need to be aware of are unhandled meaning we probably
had to take a closer
look at that mitigated which means hey we want to be aware of it but you know
on its own that the
attack wasn't successful and contained also implies that the trouble device or
that trouble system
has been quarantined and depending on the version of 40 allies you're running
uh these options
regarding looking at the actual events maybe in a different location but
hopefully very findable
so again this is the latest and greatest feature version as of this recording WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so again this is the latest and greatest feature version as of this recording
this is version 7.63