I'd like to walk you through one more example of leveraging events and
incidents in tracking
a bigger problem or issues that are happening on the network. So here we are in
40 analyzers.
Let's begin by going to incidents and events and let's start off by going to
event monitor.
And what I'd like to do is take a look at the last, let's go ahead and say the
last hour.
So there's been a bunch of events that have been created. Again, those are all
created
courtesy of our wonderful event handlers right here. And so let's go ahead and
do a sort. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do a sort. So
if we have a custom view that we can use, we can choose that. So I've got a
custom view. If
you use the drop down here, I've got one called critical, which is filtering
just on severity
equals critical. So we'll go and say last hour. And here we have this Linux
client.
Wow, busy Linux client. So all of these are critical. They're all in the event
type IPS. And
they have all happened within the last hour. Let's actually go down to the last
30 minutes. Yeah,
that's a lot. So let's go ahead and grab all these. And what we'll do is we'll WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's a lot. So let's go ahead and grab all these. And what we'll do is we'll
right click and we'll
simply with the drop down here, create a new incident. If it fits into the one
of the categories that's
predefined for us, we can use that or we could go ahead and click on the plus
symbol and so let
me create a new category. And let's call it not sure yet. And I just lost
connectivity to my 40
analyzer. And I am not sure why. However, I did launch a whole bunch of attacks
in the last 30
minutes. So I could have caught something here in my lab environment. I'm not
sure. We'll find WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sure. We'll find
out here in a moment. All the attacks that I launched were from little VMs, not
from my management
PC here. So let me go ahead and let me do a refresh and advanced and continue.
All right,
let's go back and take a look at the last 30 minutes. In fact, let's go the
last hour. Great, great,
great. And I think we created the incident. I think it took so let's go take a
look. We'll
get incidents and no, it didn't create so let's go ahead and take these
existing incidents, get
it out of the way, right click and delete and okay. And let's go back to event
monitor and let's go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
monitor and let's go
back to the filter for the last 30 minutes. And we'll right click here and do a
filter matching only
on critical. And sure enough, there's our client. Wow. Okay, that client's been
pretty busy. So we'll
do is we'll right click once again. And we're going to take all 65 of those
events. And we're
going to create a new incident. And for the category, I'm going to go ahead and
click in the plus symbol
and call it not sure yet. That's where it blew up on us last time. So we'll
click on okay.
Now that's better. And for MITRE Tech, I'm not sure yet, which I do that would
be severity.
They are all critical. So we're going to leave it high. And for the status, I'm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They are all critical. So we're going to leave it high. And for the status, I'm
going to go ahead
and let's go and put it into analysis mode and for the description, for the
description, we'll put
need to sort this out. And then we'll assign that to myself. And we'll click on
okay. All right. So now
we have a new incident with all of those events. Let's go to incidents. And
there it is. And let's
begin. So we'll double click on the incident. So the effect at endpoint is 80
user two at the IP
address 1020 0.102 with this MAC address. So if there's a whole bunch of stuff WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address 1020 0.102 with this MAC address. So if there's a whole bunch of stuff
happening with that
IP address right now, I might want to take a moment and find that device find
that user and basically
turn off that device physically or forget the option within point software
running on that device.
We could quarantine it. But certainly there's a lot going on. So let's go ahead
and scroll down.
So here's the attack timeline. We can also scroll with the mouse to go ahead
and make that larger or
smaller. I'll go ahead and continue scrolling down. And here are the events. So
let me go ahead and
use the gear. I'm going to remove the column for suppress and leave everything WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
use the gear. I'm going to remove the column for suppress and leave everything
else there. Let's go
back and take a look. So as we scroll down, there are some intrusion port
scanning. As we continue
to scroll down, there are some SQL injection happening. So I was going to grab
one of these right click
on it. And I want to do a search and log view. And that's going to take us out
into another pane
of glass where we're going to go into logs. And that way I can come back here
right where I left
it. So we'll click here search and log view. So here in log view, let's go
ahead and narrow it down
to that IP address, which is 10 dot 20 dot 0 dot 102. So currently, I'm only WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to that IP address, which is 10 dot 20 dot 0 dot 102. So currently, I'm only
looking at HQ firewall
one. I'm going to go ahead and say I want to look at all devices, click OK. And
here I'm going to
specify the last hour. And then this is the traffic logs we're looking at. Let
me go ahead and let's
go to security and IPS. And these are all about that machine at 1020 0 dot 102.
So we're using HTTP,
going to this IP address, which is in the US. Oh, and then there's a whole
bunch of other
addresses here 23 dot 102 shows us Spain. But that's the little subnet I use
here in my lab
environment that represents the rest of the internet. And here showing TCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
environment that represents the rest of the internet. And here showing TCP
protocol number four. So if
we want to know more about that, I'll double click on that and scroll down. Oh,
that's the
decision port. So the source port was a high number for 49,026. And as far as
destination port of four,
I'm curious what that is. So I'm going to do a quick search and look up TCP
port number four.
So port number four is not an assigned well known port. All right, so that's a
little bit concerning.
And so I might want to leverage here. I might want to leverage the option here
for threat hunting. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for threat hunting.
And that way, threat hunting, I can go ahead and search based on some
categories. So I'm going to
go ahead and start here with source IP and the address is 10 dot 20 dot 0 dot
102. This is just
right here. So let me right click on that and I'm going to add that to hunting,
which effectively
is just adding a filter here. And let me also go ahead over to a threat name
and look at all these
threats and that filter in place means they're all associated with that IP
address. So some
port scanning, some malicious websites, some unrated websites, and also a SQL
injection attack. And
if I want to focus on destination here, we can click on destination. And a lot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if I want to focus on destination here, we can click on destination. And a lot
of these, oh,
these would have been for a scan. Looks like they're scanning the entire subnet
and for the threat
type. So the reconnaissance here, those were all blocked. That's why it's
yellow there. And risky
destination. If we don't click on that, it'll put a filter in for us. Then we
can take a closer
look. It looks like these are all some name resolution. So let me close that.
So this is a great way of
drilling into the logs as we need to, taking a closer look at the nitty gritty
details. So I'm
going to go back to the original pane for the Fort analyzer, back to our
instant analysis. And if
other people are working on this as well, I could click on refresh and get the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
other people are working on this as well, I could click on refresh and get the
latest and greatest
information here. And here's a sequence. In fact, there's two SQL injection
attacks and go ahead
and click on that. And I'm going to go ahead and do a view logs for that first
one. And look at
the details. So here, this was reported by firewall one, the destination was 65
.61.137.117. We scroll
down on a thread of the SQL injection attack. If you scroll down further, it's
going to test
fire. So that's a test website from IBM. So that may not be too much of a real
risk. Let's take a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
risk. Let's take a
look at the other one. So here, if we click on this second one, and we click on
view logs, and then
we don't click on the details here and we scroll down. This is also a SQL
injection attack as it
showed right here. And if you scroll down, where was this one going? This is
also going to test fire.
Because it looks like it was not going to a production website, where they're
really trying to
attack somebody. And the risk looks like port scanning. So I'm going to go to
reports. So here,
with all reports selected, I'm going to search for 360. And here's a 40 gate
360 security report.
I'm going to go ahead and select that. And I'm going to go ahead and run that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to go ahead and select that. And I'm going to go ahead and run that
report. We can do
either by clicking on run report or right clicking on it. And then from here,
selecting run report.
And in a moment, that will be generated. And we can associate that or attach
that
to our incident. So here's the generated reports. And based on the timestamps.
And there is our running
report right there. Okay, fantastic. So that'll be ready here in a moment or
two, there's a little
progress bar over on the right for status. And once it's done, we can right
click and associate
that or include that as part of our incident. All right, that report is almost WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that or include that as part of our incident. All right, that report is almost
ready. All right.
So we'll right click on it. And what we can do is add that to an existing
incident, which we will.
And there's our only incident I deleted the other so we'll select it and click
on. Okay. All right,
it's been successfully attached. So now to go back to the incident and events
and go to our incidents,
that report is now included there for taking a look at. So if we scroll down
under the reports
widget, it's right here. So we can go ahead and click on the PDF and it'll open
it up for us.
And the data included here is based on that 360 report definition. Some Wi-Fi, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the data included here is based on that 360 report definition. Some Wi-Fi,
top 10 policy
by bandwidth, top 10 policy by session, top 10 policy details, top sources, top
destinations.
And as we continue to scroll down, here's threat detection prevention,
application visibility and
control. And as we continue to scroll down, here we have top 10 web categories
by visited,
top five viruses bots, spyware, adware, phishing sites, top five victims of
malware,
top five malicious phishing sites, and application vulnerabilities. So here for
the SQL injection,
it's showing a count of 13, many of those which recently happened. So this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's showing a count of 13, many of those which recently happened. So this
report may not be too
valuable for the incident that we're currently working on. So we might want to
choose a more
detailed report focusing on the events that are happening. I just kind of
grabbed one at random.
So based on this incident with the events that are included, it looks like the
client was doing a
lot of port scanning. And the handler that picked it up was the default
malicious code detection.
So if the client had some malware installed and that malware was beginning to
scan other parts of
the network, that's what caught it. So this default malicious code detection by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the network, that's what caught it. So this default malicious code detection by
endpoint handler
matched on this rule right here intrusion detection group by destination
endpoint.
So we'll close that. And if we think there's other events that should be
associated with this
from that client, we could go back to event monitor. And I'm going to go ahead
and specify
for the last four hours, and I'm also going to remove the filter for just
critical. And let's
take a closer look at this one. So this also was a source user 10200102. So
that's also suspicious
we can right click on that one and add that to our existing incident. So here's
our incident. We'll
add that click on OK. There's another DNS request made to a malicious WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
add that click on OK. There's another DNS request made to a malicious
destination. So
let's double click on that and open up the details. And that was successful. So
that was a malicious
website and the DNS resolution was successful. So it was a DNS request to a
malicious website.
So let's remove the lows and mediums. I'll right click here and say we don't
want to see the lows.
And let's also say we don't care about seeing the mediums. So add that under
search here say and
not medium. And that was just leave our highs and criticals. So the port
scanning we know about
the SQL injection we took a look at. And those events are already included as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the SQL injection we took a look at. And those events are already included as
part of our incident.
But this DNS request and that one and that one and that one and that one, which
all just recently
happened, they could be also associated with that user, Cisco, and grab all
those and right click.
And we'll add those to the existing incident as well. So there's our incident.
We'll select it
and click on OK. So it says successfully added seven events to that incident.
So now as we scroll
down, we have these additional events included as part of our incident. So we
select one of those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
select one of those.
Sure enough, it is 80 user two. And if we double click on the details, that was
an A record request.
So this customer is successfully able to resolve names to IP addresses for
malicious websites.
In this example, that was the website right there. And this is being reported
by firewall one.
Also, this log was created from this profile called DNS monitor. And the
protocol was UDP that 17
and was coming from 80 user to. So what we might want to do is take a look and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and was coming from 80 user to. So what we might want to do is take a look and
see what the heck
is going on with firewall one that would allow all this type of malicious
activity to happen.
Port scans, SQL injections, and also name resolution for malicious websites.
And again, if we wanted to go ahead and do additional searching, we could do a
search and log view,
which again, opens up a separate pane. Once again, we get a threat hunting for
the time frame that
we want to look at, go to source IP, give it a moment to refresh. And then here
we could add
that as a filter or just view the raw logs by clicking on view logs. And then
it'll put the
filtering for us. So if we want to not see the notices, we can go ahead and say WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
filtering for us. So if we want to not see the notices, we can go ahead and say
, don't include
notice and right click and say, and not informational and not warning by
clicking add and filter events
ready, not equal to warning, and then further drill down into any of these
specific logs.
So it appears based on the logs that we're looking at and the ones we've added
into the
incident. And we see that by going back to incident events and the incidents
looks like this user,
which is 80 user to a disciple address had issued several SQL injection attacks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is 80 user to a disciple address had issued several SQL injection attacks
,
which are shown right here. They also did some port scanning of some networks
looked like it was
in the 23.1.2 address base, and also made a ton of DNS requests that were
successful regarding
malicious websites. So it could end up being an end user that is curious and
trying out some things,
or it could be some malware that's installed on their computer that's trying to
make these
outbound requests, including the scans. And behind these events, if we look at
the details here in
the logs, they're all coming from firewall one. So the proper course of action WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the logs, they're all coming from firewall one. So the proper course of action
would be a couple
things. Number one, we'd want to lock down that device that IP address. So it
can't do additional
harm or damage. We'd want to have chat with 80 user to probably with HR
regarding policies,
acceptable use policies. And we also want to make sure that on the firewall
firewall one,
that we correct the security issues that allowed that traffic to happen in the
first place,
because most of that traffic was allowed. So if we go back to firewall one, we
can also see the
logs here as well. If you're good at a login report and good or security events
, I'm going to go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
, I'm going to go
ahead and tell it to pull from memory. And let's go to IPS. And sure enough, it
was 80 user two.
There's a SQL injection, there's the port scanning. And so the fact that they
were able to do that,
let's just open up one of these. And here we can also see what the policy was
here on firewall one
that allowed that. So right here, we have a policy idea of temp for vendor. Oh
my gosh. So it very
likely could have been some policy was put in place for the benefit of a vendor
. It says temp.
Maybe they needed to test something. And it wasn't approved. It didn't go WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe they needed to test something. And it wasn't approved. It didn't go
through change control.
And unfortunately, it's allowing this user 80 user to to send out a lot of
traffic that shouldn't be
going through the firewall. So let's go find that policy. So we go to policy
and objects.
Go to firewall policy here on firewall one. There it is right there. If we
double click on it,
take a look at the profiles associated with it. It looks like it's allowing any
traffic coming in
from the 1020 zero subnet traffic coming in on the inside zone being routed out
of the outside zone.
It's being allowed. There's the name temp for vendor. It's proxy based. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's being allowed. There's the name temp for vendor. It's proxy based. And
here are the security
profiles which are effectively monitoring everything, which I also imagine
based on the results is not
blocking on anything. So having the correct security profiles in place here or
possibly just even
disabling this policy altogether by right clicking on it and going to set
status and clicking on
disabled that should prevent assuming this next policy here has the correct
security in place
that should start preventing a lot of the attacks that we just saw. So if we
open this one up,
this is allowing seven at 20 and 30. And if we scroll down, it looks like we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is allowing seven at 20 and 30. And if we scroll down, it looks like we
have some better
security profiles in place. And that temporary one, unfortunately, it was being
matched, which
also means that new traffic coming through with that temporary one from the
vendor wouldn't require
authentication. Now fortunately, our 80 user to initially went through and they
got authenticated.
That's why we know it's 80 user to not just an IP address, but new devices that
came up where
the 40 gate did not yet know exactly who the user was behind that IP address.
If there's no policy
in place like this temp for vendor with no group authentication required, those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in place like this temp for vendor with no group authentication required, those
IP addresses would
go through without a username required to be associated with them. So in this
case, it was a
temporary policy that was put in place that was very, very lax. And that was
causing our security
issues by allowing traffic through the firewall that shouldn't have been
allowed. So if we go back
to the 40 gate and we go to our instant here, what we can do is we can add a
comment. So here in
the comments, we'll say temporary, on off, sec policy rule, emergency change
control used to
disable it. And also, of course, you'd want to go through whatever change WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
disable it. And also, of course, you'd want to go through whatever change
control is required
before you just go in and make a change on a production system. So I'll click
on post here.
So all the other admins can see that also go back to instance, then right here,
I'll right click and we can go ahead and edit it. And I changed the status from
analysis to
closed. And if I want to update the description here also to indicate there was
a temporary policy,
I can put it here as well, we could also update the name. So I'll say the
temporary policy was
too lenient. And then down here in the description, we could update the
description. And it's usually
a good idea to just add information instead of replace it. And that way, there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a good idea to just add information instead of replace it. And that way, there
's a history
regarding what exactly happened. So click on okay. And that incident is now
closed. And in your
organization, there's gonna be policies and procedures regarding what to do
when certain
events are found, and the process for dealing with assigning and following up
with incidents.