In this video, I'd like to walk you through some cases where we might need to
create a custom
event handler, either a basic one, where that event handler based on any of the
rules in it
would trigger and create an event or a correlation event handler. Again, the
difference is the
basic is any rule that matches is going to trigger where a correlation, all the
events that are
specified in that correlation event handler have to happen within the
parameters are specified as
part of that handler. And actually, now I think about it, I also want to take a
moment and maybe
just demonstrate how a correlation event handler is functioning based on a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just demonstrate how a correlation event handler is functioning based on a
series of events. And
then after I do a quick demo, we'll get into the creating and using a custom
event handler. So
here in the 40 end laser, as a demo of a correlation event handler, we'll go to
incident events and
go to event handlers. And let me make sure we're looking at all of them. So
currently, if we go to
more and show custom, I have no custom ones. So let's take a look at all of
them. Fantastic.
And let's scroll down. And here's the great one right here. So the icon
indicates it's a correlation
event handler. And it's for brute force account logins against the 40 gate. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
event handler. And it's for brute force account logins against the 40 gate. So
based on the rule
here, let me just open it up says this handler is to detect if an account login
failed many times,
not followed by a login success for 40 gate. And if we scroll down here,
showing the correlation
sequence, so it's login failed five times, not followed by a successful login.
So that's the
correlation. So to trigger this, what we could do is log in, you know, five
times or fail to log
on a 40, five times, and then not log in for five minutes successfully. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on a 40, five times, and then not log in for five minutes successfully. And
that should trigger it.
Now, unfortunately, on a 40 gate firewall, the default server in place will
only let you log in
three times. And then it gives you a five minute timeout. So let's, let's set
ourselves up for
success in demonstrating this correlation event handler. So to do that, let's
go over to firewall
two. So here's firewall to a login, I'm going to log in successfully, because I
need to change
a few parameters first. And here on firewall to let me go ahead and click on
the icon for a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the icon for a
command line interface, and let's do a config system global and let's do a show
full configuration
and hit space bar. And there are a lot of options here. So let's do this look
for the set admin,
oh, which is right here near the top. So here's the set admin lockout threshold
of three. So basically,
three failed attempts is going to lock me out for, I think that's 60 seconds.
Now,
I don't think that's the default I may have changed that. I thought the default
was five
minutes in any event. Currently, we'll never get to five failed login attempts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
minutes in any event. Currently, we'll never get to five failed login attempts,
if it's going to
lock us out of three and make us wait, or I guess we could, but instead of
doing that, let's just
change the lockout threshold to something higher. So I'm going to go ahead and
copy this first part
here, right click copy, then we'll paste that in. And I'm going to go ahead and
set it to 10,
press center. And that way, I don't have to wait here at the local 40 gate to
do more than five
failed login attempts. So go ahead and type in and there we'll close that. And
then what we'll do
is we'll click on admin and we'll log out and then I'll log in as admin. In WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we'll click on admin and we'll log out and then I'll log in as admin. In
fact, let me use a
different username as well as couldn't do bogus and a bad password. And let me
try bogus, another
bad password and bogus and bogus and another bad password. In fact, you know
what, that doesn't
mean a valid username. Let me try admin. Keith, don't think too much on the fly
. Anyway, I'm going to
do admin just to make sure that we're looking for the admin account there who
does exist in the
system and bad password. Oh, yeah, see, it's trying. There we go. Yeah, I think
I need to do admin WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I need to do admin
account five times for a valid user account because it's thinking about it
failing because the admin
accounts valid, but the password isn't I think that's three times and now four
times and five times.
And I'm going to do one more just in case I got the count from and hopefully it
's under 10
because I also want to be able to re log in. So in the correlation event
handler, he was looking
for five login attempts that failed, not followed by a successful login for
five minutes. So what
I'm going to do here is I am not going to log on to what is this firewall to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to do here is I am not going to log on to what is this firewall to
and we're going to go
back to 40 analyzer and wait a little bit. So we'll go back to event monitor
and I'm looking at all
events for the last five minutes. Fantastic. So there's nothing showing up
right here, but once
it hits, it should show up if we do a refresh. So I'm going to pause the
recording here for a bit.
And then once it shows up, I'll resume the recording. So due to the magic of
editing and
pausing the recording, we aren't going to have to wait five minutes. And
actually, you know what,
while we're waiting, we could actually take advantage of our time by going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
while we're waiting, we could actually take advantage of our time by going to
event handlers and I can
walk you through how to create a custom one. So to create a custom event
handler, you simply click
on create new and then put in all the details. Now, because there are so many
possible, you know,
options and details, what we might want to do is take an event handler that's
close to what we need
and clone it and then tweak it. So for example, here's the default botnet
communication detection event handler. So if we right clicked on that one and
clicked on clone,
we go ahead and start there. So we'll call it our botnet detection handler, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we go ahead and start there. So we'll call it our botnet detection handler,
just like that.
And we'll leave most of the details in place. But you know what, we could also
remove or disable some of these rules because we don't really need to match on,
you know,
the one we're going to test. So as a demonstration, let me disable all of them,
except for this one
right there, that we can do the same test we did before. And if you wanted to
delete some of these,
we could just put them in the trash can by removing them, either way is great.
So we effectively
have this one rule. There's also an option for notification profiles. If you
create notification
profiles, for example, sending to email or syslog or other notification options WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
profiles, for example, sending to email or syslog or other notification options
, you can then
select the notification profile. And when this hits, when this event handler
hits and has its
matches, in addition to creating the event, it would also go ahead and act on
whatever notifications
we had set up. So for now, I'm going to click on, okay, so now we have a custom
one, I'm also
going to go ahead and right click on this one. And I'm going to disable it. So
this one from the
factory now is going to be disabled. So if I sort by status here, the one right
here is now
disabled shown by this icon. However, if we get a more and we say, please don't
show a predefined, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
show a predefined,
just custom hour one that when we made is still enabled. So let's test it out
and verify that it's
going to go ahead and create an event for us. So to try that, let's go back to
our client,
we'll go to PC to, and we'll hit the upper key and do a name resolution for
combat shell.
Another one for office RSVP. Now that's done, let me go ahead and minimize that
. And in a little
bit, if it creates the events for us, we should see the event show up right
there. Or we could just
go to events. And there's our default brute force account login attack that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go to events. And there's our default brute force account login attack that
triggered fantastic.
That's there. And also, if we click on refresh here, we should have our DNS.
And that was matched on
by our handler called our botnet detection handler. And that's why we're seeing
this event
right here is based on our botnet detection handler. Also, I don't want to
leave that other
one disabled. So I'm going to go ahead back to event handlers, I'll sort by
status, we'll scroll
down, and that's going to be the search for botnet and then sort by status. And
this is the one right
there that we disabled. So I'm going to go ahead and I'm going to enable it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there that we disabled. So I'm going to go ahead and I'm going to enable it.
And also I'm going to
right click, and I'm going to say factory reset and click on okay. And because
we don't need to,
I'm also going to go to more and show custom only. And right click on this one
that we aren't
going to need anymore because we have the default one in place. And I'm going
to go ahead and delete
it and say goodbye with an okay and audio some me go. And then we have our pred
efined botnet
communication detection in place. It's enabled. I'll sit back to the default.
And just to confirm
all the rules are enabled and it's ready to go. So we'll click on okay. And
just as a quick test, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just as a quick test,
let's go back to our client and do a couple more name resolutions. And we'll
minimize that. And
then the new events that come in that are indicating that our client was trying
to do name resolution
of some command and control domains. Those should show up now, but they should
show up as having
been caused by this default botnet communication detection event handler. So we
'll go back to event
monitor looking at the last five minutes, and we'll expand our Linux client
here. And sure enough,
we had one that was identified by our botnet detection handler. And then going
forward,
it was using the default botnet communication detection, because we deleted our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it was using the default botnet communication detection, because we deleted our
custom one.
And then we just restored the settings for the original one. So the moral of
the story for most
people is going to be if you have an event handler that you need to create a
custom one for, it's
very likely going to be at the instruction of for net due to something that
just recently happened,
and you need to temporarily create your own event handler, because in a matter
of days, or when
the next update comes out, it's very likely that whatever problem they had
identified on the network,
they're probably going to update with a default event handler to address the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they're probably going to update with a default event handler to address the
current situation.