Instructor: Security information
and event management systems, SIEMs.
Now, log review is a critical part of security assurance.
We're going to gather logs from all sorts of different systems,
but gathering logs does you no good
if you don't actually look at those logs.
Now, logs shouldn't be reviewed just after an incident.
You shouldn't use them just as part of an instant response,
for example, but you should look at them regularly
and routinely as part of your threat hunting
and proactive system management.
To do this effectively though,
you really do need to use a SIEM.
Now, a SIEM is a solution that provides real-time
or near-real-time analysis of security alerts
generated by network hardware and applications.
Now, as we look at a SIEM, there's a lot of uses for one,
but one of the best things they do
is they help us correlate events.
Let's take a simple example.
You're looking through the logs
and you see that somebody has logged in over VPN from Asia,
it's John Smith, and he's logging in from Asia
because he's on a business trip.
Well, there's nothing wrong with that.
But if you look at just moments later
you see the John Smith's ID has been used
to log in to the server room in your building.
Well, that's an issue because he can't both be
in your server room and on a business trip in Asia.
So one of those two things is wrong.
Now, either one by itself is fine,
but putting those together
and correlating them flags as something
that we need to look into
and figure out where is this person
and how is he in two very different places,
both at the same time
a SIEM helps you do this very quickly and very easily.
Now a security and information event management system
or a SIEM, can be implemented in many different ways.
You could do this as software, hardware appliances,
or even as an outsource managed service.
Now, to effectively deploy a SIEM,
you have to consider a lot of different things.
First, you need to be able to log all relevant events
and filter out anything that is not considered relevant,
anything that's irrelevant data.
Second, you need to make sure you can establish
and document the scope of the events.
Exactly what are you going to log?
What is inside and outside of your scope.
Third, you need to develop, use cases to define a threat.
This will help you to find exactly what you do
and do not consider a threat
and then what you may take action on later.
Speaking of that, that brings us to number four.
You need to plan instant responses before given events.
If you know that when you see this type of thing happen,
you're going to take those type of actions,
that's what we're talking about here.
It's preplanned responses for any kind of given threat
you might face.
Fifth, we want to establish a ticketing process
so we can track all these different events that we flag,
this way as we go in the SIEM
and we see something that's unusual
like my example earlier with somebody logging in from Asia
and at the local office at the same time, you can flag that
and have it tracked throughout the process
to make sure it doesn't get dropped.
Sixth, we want to schedule regular threat hunting.
Now, by doing this, we want to make sure
we're not missing any important events
that may have escaped alerts.
By going through and doing threat hunting,
we're going to be able to catch bad guys doing bad things
that may have escaped our alerts.
And finally, our seventh item is providing auditors
and analysts an evidence trail.
A SIEM is a great place with a centralized repository
of lots of different data.
And so it's a great place for auditors
and analysts to look through
as they're doing their analysis.
Now, when I talk about a SIEM solution
there are lots of different seams solutions out there.
There are many commercial
and open-source solutions available
and it's up to you to decide which one you want to use.
As we go through the rest of this lesson,
I'm going to bring up a couple of them
and show you what they look like.
We're going to cover things like Splunk, ELK, or Elastic Stack
ArcSight, QRadar, Alien Vault, and OSSIM and GrayLog.
Let's start with Splunk.
Splunk is a market-leading big data information gathering
and analysis tool and it can import machine generated data
via a connector or a visibility add-on.
Now, Splunk is really good at connecting
lots of different data systems.
In fact, it has different connectors built
for most network operating systems
and different application formats.
Essentially all the data from all the different systems
can be indexed as it's taken off those systems
and then written to a centralized data store.
This allows Splunk to be able to go through historical
or real time data and be able to search through it
using its proprietary search algorithms
called the search processing language.
Now, once you get those results,
you can start visualizing it using different tools.
So when you use Splunk, it looks something like this.
Notice here I have what looks like a dashboard,
on here, I can see the important information.
I see a lot of data,
I see the trends going up or going down,
I can see events over time
and I can actually drill down by clicking into each one
by going in and looking at the data behind it as well.
Splunk is a really great tool
and it can be installed locally
or as a cloud-based solution.
When you buy Splunk, it comes with a lot of templates
and pre-configured dashboards,
security intelligence searches,
and instant response workflows.
Splunk is a big player in the marketplace
and it is a great SIEM to consider.
The next one we want to talk about is ELK or Elastic Stack.
Now ELK and Elastic Stack is a collection of free
and open-source SIEM tools that provide storage,
search and analysis functions.
Now, ELK and Elastic Stack is actually made up
of four different components.
These are the Elasticsearch
which covers the query and analytics.
Logstash, which is your log collection and normalization.
Kibana, which does your visualization
and Beats, which is your endpoint collection agents
that are installed on the machines.
The way these all work together
is you're going to have the different Beats
installed on different servers or hosts.
And they can then send out either directly back
to the Elastic Stack, or it can go into Logstash first.
Now, when it goes into Logstash first
it's going to do the parsing and the normalization for you,
and then send it into elastic.
If you go directly to elastic,
it has to be in a format that it already understands.
Now, elastic is that centralized data store,
but you don't really go into Elastic to look at the data
instead you use Kibana
and Kibana, goes into elastic and then visualizes that data
in a way that you can see and understand.
Just like Splunk, ELK Stack maybe install locally
or as a cloud-based solution.
Our third SIEM tool we're going to discuss is ArcSight.
ArcSight is a SIEM log management
and analytics software that can be used
for compliance reporting,
for legislation and regulations like HIPAA, SOX,
and PCI DSS.
When you look at ArcSight, it looks like another dashboard.
And again,
you can drill down into that information
and display it in lots of different ways.
The fourth one we're going to talk about is QRadar.
And QRadar is a SIEM log management, analytics,
and compliance reporting platform created by IBM.
It does a lot of the same stuff we've just talked about.
And again, it comes with a nice dashboard.
As you look at the dashboard,
you get different things that you can be looking at
and considering those for your network.
Our fifth one is Alien Vault and OSSIM,
the open-source security information management system.
Now, this is a SIEM solution
that was originally developed by Alien Vault
which is why it's called Alien Vault,
but now it's owned by AT and T
and they've been rebranding it recently
as AT and T Cybersecurity.
Just like the other ones,
it does come with a dashboard where you can search
and dig into the different information
that could be presented here.
Now, one of the nice things about Alien Vault and OSSIM
is that OSSIM can integrate other open-source tools
such as Snort IDs and OpenVAS vulnerability scanners
and it can provide an integrated web administration tool
for you to manage the entire security environment.
So it does give you this nice all in one solution.
Also, because you're using a lot of open source tools here,
it does keep your costs low.
The final one we want to talk about is GrayLog
and GrayLog is an open-source SIEM
with an enterprise version that's focused on compliance
and supporting IT operations and DevOps.
And again, it has a nice dashboard where you can drill down
and search for things.
The big difference with GrayLog is that it's really focused
on DevOps and supporting IT operations,
as opposed to doing more of the log analysis
and the incident response that some of the things
like Splunk are much better suited for.
Now, let's talk about the exam for just a moment.
You do not need to know specific tools
like the ones I mentioned in this lesson.
We covered them here simply to make sure
you were introduced to the brand names
and the different tools.
If you hear any of these names you should know,
they have the ability to act as a SIEM,
but beyond that, you don't need to know how to use them
or operate them for the exam.
Now that said, a lot of these open source tools
make a great addition to your own practice labs
and your own home networks.
Because if you're building out your home network
this will give you experience using these tools hands on.
This will make you a much better analyst in the real world.
Now in the real world, which of these tools should you use?
Well, that depends,
which company are you trying to get a job at?
Or which company do you already work for?
As I've worked at different companies
and organizations over the years,
we have used several of these different tools
including Splunk, ELK Stack, and Alien Vault
in some of the different organizations I've worked with.
So I have experience with all of those.
Is one better than the other?
Well, it really does depend on your use case,
but really when it comes down to it,
it's what your boss likes
and what your company's already using.