In this video, I'd like to walk you through the birth of an incident.
And because there's a few ways that that new incident can be created, I'd like
to demonstrate
them. So one of the first ways of creating an incident would be to take an
existing event
and then manually right clicking and say that we want to create a new incident
based on that event.
So let's start there. So here at the 40 Analyzer, starting off, let's go to
incident events. We'll
go to the event monitor and then let's go ahead and take a look at the last few
weeks. I'll say
the last three weeks and we are looking at all events from all devices. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the last three weeks and we are looking at all events from all devices.
Fantastic. So let's put
a filter in place. In fact, we created some custom views where we have a view
looking just for
critical so we can choose that and just look at our critical events. And let's
open up this top one
and this is regarding IPS. What we could do is we could right click on the
heading here,
which includes all four of these events. And then what we could do is from the
drop down,
after right clicking, click right here on create new incident. This is an
example of what is in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
example of what is in the
documentation termed as raising an incident or creating an incident from these
events. So we'll
click here on create new incident. So let's go ahead and rename this to a SQL
injection activity
or maybe we say possible SQL injection activity. In fact, let's just call it
possible malicious
content from a client and in fact, we'll call it a device because it may not be
a user. It could
actually be a device on our network that has malware that's trying to do a SQL
injection attack
through the firewalls. Then we have incident categories. So from the drop down, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
through the firewalls. Then we have incident categories. So from the drop down,
let's go ahead
and let's just for now we can call it improper usage. And then for the miter
tech ID, if we
knew specifically where it fell into, we could go ahead and select it. So if we
scroll down,
we can also search. So let me see if there's a SQL option here. It's not a
stored procedure. So
I'm going to go ahead and leave that blank for now because I don't think it's a
really great match
for it. We'll click on cancel. And then for this severity, because all those
events were labeled as
critical, I'll go ahead and leave that as high. Fantastic. And then for the
affected endpoint, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
affected endpoint,
it's already baked in because of the IP address associated with those events
that were created
by the event handlers. And then for here, we'll say not sure what's going on,
but want to find out.
And then as far as assigning it, we could go ahead and assign it to any of our
users. So
I'll go ahead and assign this to the admin and then click on OK. And bada bing
bada boom.
We just successfully created a new incident and we attached these four events
to the incident.
Now where would we go to see the incident? The answer is under incidents and
events. You got it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
events. You got it
right here. We'll click on incidents. And here we go. There's our brand new
incident. It's called
possible most activities, they're already high, affected in point 1020.102.
There's the description,
it's new, and it automatically gave it a incident number just incrementing from
where it left off.
So in earlier, I created a few incidents in preparation for this. And so I
deleted them all before now,
but now we're up to incident number a whole bunch of zeros and a nine. And as
far as the columns,
if you want to do less columns, you can. And then if we scroll over, in fact, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if you want to do less columns, you can. And then if we scroll over, in fact,
let me just collapse
the left hand side, we're under incidents and events incidents. And if we
scroll over to the
right, we can see the additional columns here. So there's the reporter and the
incident category.
And if we wanted to see or not see some of these columns, we could simply
remove them by using the
gear icon, which would control our columns for us. Fantastic. Also over here
has a nice
church grant severity status and category. If you don't want to see those, you
can just right
here toggle these show charts option and it removes it. If you want to see them
back, you can click
there to bring them back. And if you want to control which chart show up, there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there to bring them back. And if you want to control which chart show up, there
's severity,
status, category, and outbreaks, we could go ahead and control that by simply
using the drop down
and selecting the charts we want to see. So I'll go ahead and use that. And
that way,
it's a nice overview of the current incidents. Think of it like a ticketing
system for looking
at problems on the network. Now, another way of creating an incident would be
to go here in the
instance and events and instance, and then simply clicking on create new, which
is yet another way
to create an incident. So go ahead and say demo incident, we could go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to create an incident. So go ahead and say demo incident, we could go ahead and
say categorized
as malicious code. If we knew the minor tech ID, let's go ahead and search for
code as an example.
And I don't see a perfect match there. So I'll leave that off for now. And then
for the status,
we'll go ahead and leave it as new. And then we get assigned this or not
assigned it. And then
we'll go ahead and click on OK. So now we have this incident. And now for that
incident, we could
take other events, for example, that we see and add them to this incident. So
we go back to event
monitor. And let's go ahead and describe this one right here. I will take all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
monitor. And let's go ahead and describe this one right here. I will take all
these events and
let's right click and simply right here from the drop down, say add to existing
incident.
It'll ask us which one will select this one right here, number 10 and click on
OK. So now
we've successfully attached those 17 events. So if we go back to incidents,
there it is. And now
if we double click on it, it has all those events attached to it and associated
with it. And if
you scroll down, here we can see those events again, just as a demo. All right,
so that's two ways
that we can create incidents here manually, or we can do it right from event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we can create incidents here manually, or we can do it right from event
monitor,
grab the events that we want to use, right click, and then create a new
incident from those events.
Now another option is we could create a brand new incident based on an event
handler that's been
programmed to create a new incident when a certain set of conditions have been
matched. So if we
go to our event handlers, let's go ahead and let's clone our default botnet
communication
detection. We'll right click on that. We'll clone it. We'll call looking for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
detection. We'll right click on that. We'll clone it. We'll call looking for
botnet activity,
click on OK, and then I'll take the default one here. I'm going to right click
and just disable it.
So now if we go to more, and if I refresh this page, it should show as disabled
. So if I go to
only show custom, there's our looking for botnet activity. And let's take a
look at the details
for this event handler. So we'll double click on it. And currently, it says
regarding automatically
create incident, it's disabled. So if we enable that, what that means is that
any of these rules
that they're matched, not only will it create an event, but it'll also add that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that they're matched, not only will it create an event, but it'll also add that
event to a brand
new incident. So let's click on OK. And let me also add a column here and then
click on the gear.
And I'm going to add the column for automatically create incident. And that's
great. And that way,
we can see when it happens. There we go. There's that column. Fantastic. It
doesn't need all that
space. We'll say automatically create incident. Fantastic. And now that that's
enabled,
let's go ahead and try to do name resolution for a domain associated with the
command and control
network. So let's go back to PC to. And as PC to is going out to the internet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
network. So let's go back to PC to. And as PC to is going out to the internet
and doing DNS,
out to a public DNS server, firewall one has the policies in place to say, if
you're doing name
resolution, and that name is associated with the command and control network, I
'm going to go
ahead and not allow it. I'm going to send you back the redirect IP addresses
configured in my DNS
policy. So let's confirm that first on firewall one. So over to firewall one,
we go. And let's go
down to security profiles. And let's go to DNS filter. And there's our DNS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
down to security profiles. And let's go to DNS filter. And there's our DNS
filter is currently
being used. And if we look at the references column, click there, it's
currently being used in this
end out with LDAP policy, which is perfect. So go ahead and close that. And let
's edit the DNS
filter just so we can see some of the domains. So it has over 80,000 domains in
the botnet package.
And we're currently doing a redirect. Let me go ahead and click share on botnet
package.
In fact, before we do that, let me also change just for grands the redirect. So
here in our DNS
filter, let me go down and I'm going to use two addresses are very, very easy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
filter, let me go down and I'm going to use two addresses are very, very easy
to recognize for
the redirect both for IP before and IPB six. So let me go to the CLI. That's a
really quick way of
getting to the right section here. And so here, let me do a set redirect portal
of 10.67.83.1.
And let me also do it for IPB six. So I'll use 2001 colon 6 783 colon colon one
. And it doesn't
like that because I need to use the redirect portal six. All right, better,
better, better. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
better, better.
We'll do a show. And now we take a look at our configuration. Here's the two
redirected
dresses, we'll type it end, and then we'll exit out and cancel that so we don't
reset it back to
the dot 100. So if we go into our DNS filter, just to confirm, we scroll down
1067 a three dot one.
And for IPB six, it'll be the 2001 6 783 address. So now it's in place, we'll
cancel no new changes
there. And back to the 40 Eliza with our looking for botnet activity, we should
have a match on
this rule right here. So let's go ahead and test. Oh, I know, I need to go back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this rule right here. So let's go ahead and test. Oh, I know, I need to go back
to firewall one.
So I can see some of the domains associated with botnet. So let me go back here
. That's where I
need to see to see some of those names. And let's bring in our client. All
right, so here's PC to
already in interactive mode for NS lookup. And let's go ahead and scroll down a
little bit here.
Let's grab some new ones. How about SA one at dot r u, the actual response was
coming back.
And the 40 gate firewall said, Oh, no, I'm going to redirect you to the address
to set up in that
DNS profile. That'll be enough. I mean, he is one. So let me go ahead and take
the client, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the client,
minimize it. And let's also cancel that here at firewall one. Let's go back to
the 40 analyzer.
So we're the 40 analyzer. The events here should increment once that happens.
But if we go now to
event monitor, let's take a look at the last five minutes. So great, we have
some events that
have been created. And it's also showing us here the handler that created it.
So there's our
event handler. So we click on looking for botnet activity is then going to show
us exactly which
rules match fantastic. So we have the event and also because that was triggered WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
rules match fantastic. So we have the event and also because that was triggered
, we also should
have a related incident, which includes the event. So if we go to incidents now
,
that, here's that latest incident. So if I sort by number, and I put 11 here at
the bottom,
there it is right there. So it named it that name. So we double click on that
incident,
we can actually change the name now to something more of our liking. But the
point I wanted to
share here is that to get incidents, we can manually create them. We can raise
them from existing events,
or we can have an event handler that says in addition to creating event, when WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or we can have an event handler that says in addition to creating event, when
the rules are matched,
we also want to go ahead and automatically create an incident, which is what we
're showing
right here. Let me close that. And so the next logical question is, okay, great
. Now we have an
incident. What do we do with it? And that, my friend, is what we get to talk
about in the very
next video. So I'll see you there in just a moment.