In this video, I like to take the next logical steps
and helping to figure out what is going on
regarding the activity behind this incident.
So we already know that we have the events that have been created.
Those events have been, let me go ahead and specify for the last three weeks.
And if we modify the columns here.
So here in Event Monitor, we know that we have some events that have been
created.
In fact, I'll go ahead and use our custom filter.
In fact, these are our custom view.
And we'll go ahead and select critical.
So we took these four events and included them as part of an incident. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we took these four events and included them as part of an incident.
So that incident is right here.
So let me go ahead and collapse the left hand side.
And in the last video, we also set it to the status of analysis, meaning we're
looking into it.
So let's go ahead and double click and scroll down.
And from right here, if we go down to the actual events,
we can actually drill into these events to find out what's happening.
Now reviewing logs, we have a few options.
One is we could go ahead and right click and say view logs or search and log
view.
We could also click on the buttons here for view logs or search and log view.
So we do view logs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we do view logs.
It's going to bring up that log information in the same pane and the same tab
and same window.
So we can double click here.
It's going to show us the details.
But if we want to go to the actual logs themselves,
we're going to want to do a search and log view, which takes us to a separate
window,
logged onto for the analyzer.
And that way we can come back to this window and continue.
So as a demonstration, we right click and we'll go ahead and do a search and
log view,
which brings up a new window.
And then from here, we can sort and start looking at the details for our logs.
Another really cool option right here in this flavor of the 40 analyzers that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Another really cool option right here in this flavor of the 40 analyzers that
under log view and logs,
we have this tab right here for threat hunting.
So currently it's looking at the last hour and the attacks that we were looking
at happened a while back.
So I'm going to say the last, how about the last 14 days.
And then here with threat hunting, we have options for sorting based on threat
action or threat pattern or threat name.
And why would you just source IP?
So if we go back to the logs and we do a view logs here, it's at 1020 0.102.
That's the source.
So if we go back to our threat hunting and sort based on IP, there's 1020 012, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we go back to our threat hunting and sort based on IP, there's 1020 012,
we could right click on that and say add to hunting, which puts a filter in for
us or just that source IP.
And then all the output here is going to be limited to just that IP address.
So we got a threat action or threat name.
It's all filtering based on that source IP address.
So there's our SQL injection right there.
So if we double clicked on that, it puts the filter in for us.
And this device at 1020 0.102 has been a pretty busy device.
So we go to the columns, we can choose remove columns or we can reset it to
default.
So I take a closer look at the details, just double click. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I take a closer look at the details, just double click.
And here's the entry for that lock.
So this is a source from HQ firewall one.
There's the date and timestamps.
The event action was dropped.
It was due to the security profile called block severity levels four and five.
So if we're on the threat, it was blocked.
And the threat name was HTTP or I SQL injection.
And there's the threat pattern.
And if we continue to scroll down, has information about our user was 80 user
two.
And they were going to test fire.net, which is a I think supported by IBM.
And it's intentionally vulnerable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's intentionally vulnerable.
It's not a production site, but it's intentionally vulnerable.
So people can test things like SQL injections.
But our users should not be attempting SQL injections going through our firew
alls.
So if we determine that was the case, what we could then do is go back into
this
and update it.
So I go ahead and close this and close this and let's go back to our main tab
for our 40
analysts, which is right here.
And then we can go ahead and update this.
So in the comments, we get out of comment, such as user going to test SQL
injection. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
injection.
Not a real threat.
Now, also, we probably want to go to 80 user two.
If that's what our end users, why are they practicing SQL injection attacks?
The answer is they probably shouldn't be from our corporate network going
through our firewalls.
Because in this case, it was going to a test website, but they could be going
to an actual,
you know, production site attempting SQL injection attacks.
And then that would be a real problem.
So we'll go ahead and click on post here.
And that way our other teammates were also adding comments to this can know WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way our other teammates were also adding comments to this can know
what's going on.
And then we'll go back and we can right click on this, click on edit.
And it'll go ahead and change the severity to, you know, something other than
high.
So we'll go ahead and say 80 user to practicing SQL injection attacks.
And then for the status, we'll change it from analysis to false positive.
Now, also, if we needed to follow up that end user, that would be, you know,
saying to include the notes as well.
So we'll go ahead and close it, click on OK.
And now that status is closed.
Also right here from these charts, if we wanted to go ahead and click on them, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also right here from these charts, if we wanted to go ahead and click on them,
for example, if we click next to new or say zero, we click there, it puts a
filter in place,
only showing us new incidents.
And because there aren't any, the list is empty.
So we click on the funnel there, go back to the closed, click on that, it'll
take us to that.
So that way you can sort based on these charts as well, just by clicking on the
hyperlinks for each of the options.