Instructor: Security information 2 2
and event management systems. 3 3
Now log review is a critical part of security assurance. 4 4
We're going to gather logs from all sorts of different systems, 5 5
but gathering logs does you no good 6 6
if you don't actually look at those logs. 7 7
Now logs shouldn't be reviewed just after an incident. 8 8
You shouldn't use them just as part 9 9
of an instant response, for example. 10 10
But you should look at them regularly and routinely 11 11
as part of your threat hunting 12 12
and proactive system management. 13 13
To do this effectively though, 14 14
you really do need to use a SIEM. 15 15
Now a SIEM is a solution that provides real-time 16 16
or near-real-time analysis of security alerts 17 17
generated by network hardware and applications. 18 18
Now as we look at a SIEM, 19 19
there's a lot of uses for one. 20 20
But one of the best things they do 21 21
is they help us correlate events. 22 22
Let's take a simple example. 23 23
You're looking through the logs 24 24
and you see that somebody has logged in 25 25
over a VPN from Asia. 26 26
It's John Smith, and he's logging in from Asia 27 27
because he is on a business trip. 28 28
Well, there's nothing wrong with that. 29 29
But if you look at just moments later, 30 30
you see that John Smith's ID has been used to log in 31 31
to the server room in your building. 32 32
Well, that's an issue 33 33
because he can't both be in your server room 34 34
and on a business trip in Asia. 35 35
So one of those two things is wrong. 36 36
Now either one by itself is fine, 37 37
but putting those together and correlating them 38 38
flags as something that we need to look into and figure out 39 39
where is this person 40 40
and how is he in two very different places 41 41
both at the same time. 42 42
A SIEM helps you do this very quickly and very easily. 43 43
Now a security and information event management system 44 44
or a SIEM can be implemented many different ways. 45 45
You could do this as software, hardware appliances, 46 46
or even as an outsource managed service. 47 47
Now to effectively deploy a SIEM, 48 48
you have to consider a lot of different things. 49 49
First, you need to be able to log all relevant events 50 50
and filter out anything that is not considered relevant 51 51
anything that's irrelevant data. 52 52
Second, you need to make sure you can establish 53 53
and document the scope of the events. 54 54
Exactly what are you going to log 55 55
what is inside and outside of your scope. 56 56
Third, you need to develop use cases to define a threat. 57 57
This will help you define exactly what you do 58 58
and do not consider a threat 59 59
and then what you may take action on later. 60 60
Speaking of that, that brings us to number four. 61 61
You need to plan incident responses for given events. 62 62
If you know that when you see this type of thing happen, 63 63
you are going to take those type of actions. 64 64
That's what we're talking about here. 65 65
It's pre-planned responses 66 66
for any kind of given threat you might face. 67 67
Fifth, we want to establish a ticketing process 68 68
so we can track all these different events that we flag. 69 69
This way as we go in the SIEM, 70 70
we see something that's unusual. 71 71
Like my example earlier was somebody logging in from Asia 72 72
and at the local office at the same time, 73 73
you can flag that and have it tracked throughout the process 74 74
to make sure it doesn't get dropped. 75 75
Six, we want to schedule regular threat hunting. 76 76
Now by doing this, we want to make sure 77 77
we're not missing any important events 78 78
that may have escaped alerts. 79 79
By going through and doing threat hunting, 80 80
we're going to be able to catch bad guys doing bad things 81 81
that may have escaped our alerts. 82 82
And finally, our seventh item is providing auditors 83 83
and analysts an evidence trail. 84 84
A SIEM is a great place with a centralized repository 85 85
of lots of different data. 86 86
And so it's a great place for auditors and analysts 87 87
to look through as they're doing their analysis. 88 88
Now when I talk about a SIEM solution, 89 89
there are lots of different SIEM solutions out there. 90 90
There are many commercial 91 91
and open-source solutions available, 92 92
and it's up to you to decide which one you want to use. 93 93
As we go through the rest of this lesson, 94 94
I'm going to bring up a couple of them 95 95
and show you what they look like. 96 96
We're going to cover things like Splunk, 97 97
ELK or Elastic Stack, ArcSight, QRadar, 98 98
AlienVault and OSSIM, and Graylog. 99 99
Let's start with Splunk. 100 100
Splunk is a market-leading big data information 101 101
gathering and analysis tool, 102 102
and it can import machine-generated data 103 103
via connector or a visibility add-on. 104 104
Now Splunk is really good at connecting 105 105
lots of different data systems. 106 106
In fact, it has different connectors built 107 107
for most network operating systems 108 108
and different application formats. 109 109
Essentially, all the data from all the different systems 110 110
can be indexed as it's taken off those systems 111 111
and then written to a centralized data store. 112 112
This allows Splunk to be able to go through historical 113 113
or real-time data and be able to search through it 114 114
using its proprietary search algorithms 115 115
called the search processing language. 116 116
Now once you get those results, 117 117
you can start visualizing it using different tools. 118 118
So when you use Splunk, it looks something like this. 119 119
Notice here I have what looks like a dashboard. 120 120
On here, I can see the important information. 121 121
I see a lot of data. 122 122
I see the trends going up or going down. 123 123
I can see events over time 124 124
and I can actually drill down by clicking into each one 125 125
by going in and looking at the data behind it as well. 126 126
Splunk is a really great tool 127 127
and it can be installed locally 128 128
or as a cloud-based solution. 129 129
When you buy Splunk, 130 130
it comes with a lot of templates 131 131
and pre-configured dashboards, 132 132
security intelligence searches, 133 133
and instant response workflows. 134 134
Splunk is a big player in the marketplace 135 135
and it is a great SIEM to consider. 136 136
The next one we want to talk about is ELK or Elastic Stack. 137 137
Now ELK and Elastic Stack is a collection of free 138 138
and open-source SIEM tools that provides storage, 139 139
search, and analysis functions. 140 140
Now ELK and Elastic Stack is actually made up 141 141
of four different components. 142 142
These are the Elasticsearch 143 143
which covers the query and analytics, 144 144
Logstash which is your log collection and normalization, 145 145
Kibana which does your visualization, 146 146
and Beats which is your endpoint collection agents 147 147
that are installed on the machines. 148 148
The way these all work together 149 149
is you're going to have the different Beats 150 150
installed on different servers or hosts. 151 151
And they can then send data either directly back 152 152
to the Elastic Stack or it can go into Logstash first. 153 153
Now when it goes into Logstash first 154 154
it's going to do the parsing and the normalization for you 155 155
and then send it into Elastic. 156 156
If you go directly to Elastic, 157 157
it has to be in a format that it already understands. 158 158
Now Elastic is that centralized data store. 159 159
But you don't really go into Elastic to look at the data, 160 160
instead you use Kibana. 161 161
And Kibana goes into Elastic and then visualizes that data 162 162
in a way that you can see and understand. 163 163
Just like Splunk, ELK Stack may be installed locally 164 164
or as a cloud-based solution. 165 165
Our third SIEM tool we're going to discuss is ArcSight. 166 166
ArcSight is a SIEM log management and analytics software 167 167
that can be used for compliance reporting, for legislation, 168 168
and regulations like HIPPA, SOX, and PCI DSS. 169 169
When you look at ArcSight, it looks like another dashboard. 170 170
And again, you can drill down into that information 171 171
and display it in lots of different ways. 172 172
The fourth one we're going to talk about is QRadar. 173 173
And QRadar is a SIEM log management, 174 174
analytics, and compliance reporting platform created by IBM. 175 175
It does a lot of the same stuff we've just talked about. 176 176
And again, it comes with a nice dashboard. 177 177
As you look at the dashboard, 178 178
you get different things that you can be looking at 179 179
and considering those for your network. 180 180
Our fifth one is AlienVault and OSSIM, 181 181
the Open-Source Security Information Management System. 182 182
Now this is a SIEM solution that was originally developed 183 183
by AlienVault, which is why it's called AlienVault 184 184
but now it's owned by AT&T 185 185
and they've been rebranding it recently 186 186
as AT&T Cybersecurity,. 187 187
Just like the other ones, 188 188
it does come with a dashboard where you can search 189 189
and dig into the different information 190 190
that could be presented here. 191 191
Now one of the nice things about AlienVault and OSSIM 192 192
is that OSSIM can integrate other open-source tools 193 193
such as Snort IDS and OpenVAS vulnerability scanners, 194 194
and it can provide an integrated web administration tool 195 195
for you to manage the entire security environment. 196 196
So it does give you this nice all-in-one solution. 197 197
Also, because you're using a lot of open-source tools here, 198 198
it does keep your cost low. 199 199
The final one we want to talk about is Graylog. 200 200
And Graylog is an open-source SIEM 201 201
with an enterprise version that's focused on compliance 202 202
and supporting IT operations and DevOps. 203 203
And again, it has a nice dashboard 204 204
where you can drill down and search for things. 205 205
The big difference with Graylog 206 206
is that it's really focused on DevOps 207 207
and supporting IT operations 208 208
as opposed to doing more of the log analysis 209 209
and the instant response that some of the things like Splunk 210 210
are much better suited for. 211 211
Now let's talk about the exam for just a moment. 212 212
You do not need to know specific tools 213 213
for the CySA+ exam 214 214
like the ones I mentioned in this lesson. 215 215
We covered them here simply to make sure you were introduced 216 216
to the brand names and the different tools. 217 217
If you hear any of these names, 218 218
you should know they have the ability to act as a SIEM. 219 219
But beyond that, you don't need to know how to use them 220 220
or operate them for the exam. 221 221
Now that said, a lot of these open-source tools 222 222
make a great addition to your own practice labs 223 223
and your own home networks. 224 224
'Cause if you're building out your home network, 225 225
this will give you experience using these tools hands-on. 226 226
This will make you a much better analyst in the real world. 227 227
Now in the real world, which of these tools should you use? 228 228
Well, that depends, 229 229
which company are you trying to get a job at 230 230
or which company do you already work for? 231 231
As I've worked at different companies 232 232
and organizations over the years, 233 233
we have used several of these different tools, 234 234
including Splunk, ELK Stack, and AlienVault 235 235
and some of the different organizations I've worked with. 236 236
So I have experience with all of those. 237 237
Is one better than the other? 238 238
Well, it really does depend on your use case. 239 239
But really when it comes down to it, 240 240
it's what your boss likes 241 241
and what your company's already using.