1 1 00:00:00,300 --> 00:00:02,460 Rule and query writing. 2 2 00:00:02,460 --> 00:00:04,770 Now, as you're going through all of your data, 3 3 00:00:04,770 --> 00:00:07,440 it comes to you in lots of different forms, 4 4 00:00:07,440 --> 00:00:09,270 and if you're just looking through log data, 5 5 00:00:09,270 --> 00:00:11,400 it's not going to be that useful to you. 6 6 00:00:11,400 --> 00:00:14,220 So instead, we write rules to do correlation, 7 7 00:00:14,220 --> 00:00:16,590 or we write queries to search information 8 8 00:00:16,590 --> 00:00:18,900 to get the data out that we need. 9 9 00:00:18,900 --> 00:00:20,880 Now, to do this, we can do this using either 10 10 00:00:20,880 --> 00:00:23,400 correlation rules or search queries. 11 11 00:00:23,400 --> 00:00:24,990 Let's talk about what each of these are. 12 12 00:00:24,990 --> 00:00:26,940 First, what is correlation? 13 13 00:00:26,940 --> 00:00:29,790 Well, correlation is the interpretation of the relationship 14 14 00:00:29,790 --> 00:00:32,970 between individual data points to diagnose incidents 15 15 00:00:32,970 --> 00:00:35,520 of significance to your security team. 16 16 00:00:35,520 --> 00:00:38,850 So if I told you that it's 32, that means nothing to you, 17 17 00:00:38,850 --> 00:00:40,590 but if I say it's 32 degrees, 18 18 00:00:40,590 --> 00:00:41,970 that tells you a little bit more. 19 19 00:00:41,970 --> 00:00:44,700 If I say it's 32 degrees and it's lowering, 20 20 00:00:44,700 --> 00:00:47,160 that tells you even more, because that's telling you 21 21 00:00:47,160 --> 00:00:49,170 that the weather is getting colder and we're going to have 22 22 00:00:49,170 --> 00:00:51,390 ice soon, because it's going to start freezing. 23 23 00:00:51,390 --> 00:00:53,790 These are the ideas of taking different data points 24 24 00:00:53,790 --> 00:00:56,190 and giving it context and correlation. 25 25 00:00:56,190 --> 00:00:57,690 Now, to do this in a SIEM, 26 26 00:00:57,690 --> 00:01:00,270 we're going to use a SIEM correlation rule. 27 27 00:01:00,270 --> 00:01:02,460 This is a statement that matches certain conditions 28 28 00:01:02,460 --> 00:01:04,710 as expressed using logical expressions. 29 29 00:01:04,710 --> 00:01:07,920 We can use things like and and or or operators, 30 30 00:01:07,920 --> 00:01:10,650 like the matches, less than, greater than, 31 31 00:01:10,650 --> 00:01:12,360 and contains symbols. 32 32 00:01:12,360 --> 00:01:15,690 Now, once we have that logic, we can create a rule using it. 33 33 00:01:15,690 --> 00:01:17,910 For example, let's say I wanted to create a rule 34 34 00:01:17,910 --> 00:01:19,350 that could be created to send an alert 35 35 00:01:19,350 --> 00:01:22,560 if multiple user log-in failures occur within one hour 36 36 00:01:22,560 --> 00:01:24,000 from a single account. 37 37 00:01:24,000 --> 00:01:25,350 What might that look like? 38 38 00:01:25,350 --> 00:01:28,020 Well, we're going to make it look like something like this. 39 39 00:01:28,020 --> 00:01:31,440 We're going to have Error.LogonFailure > 3, 40 40 00:01:31,440 --> 00:01:33,510 so if more than three log-in failures, 41 41 00:01:33,510 --> 00:01:36,750 and the second condition, log-inFailure.User, 42 42 00:01:36,750 --> 00:01:39,870 which says there was a log-in failure for this user, 43 43 00:01:39,870 --> 00:01:42,300 and the duration was less than one hour. 44 44 00:01:42,300 --> 00:01:44,850 So what this says is this rule for this SIEM 45 45 00:01:44,850 --> 00:01:47,010 says if I have three log-in failures, 46 46 00:01:47,010 --> 00:01:50,148 from one user within one hour, send an alert. 47 47 00:01:50,148 --> 00:01:52,320 Now, that works great, and this is what we call 48 48 00:01:52,320 --> 00:01:55,410 a correlation rule, but correlation rules 49 49 00:01:55,410 --> 00:01:57,210 depend on normalized data. 50 50 00:01:57,210 --> 00:01:59,370 If you have data from all sorts of different datasets 51 51 00:01:59,370 --> 00:02:01,410 and it's not parsed and normalized first, 52 52 00:02:01,410 --> 00:02:03,420 you can't compare it, and so we need to make sure 53 53 00:02:03,420 --> 00:02:05,370 that normalization happens. 54 54 00:02:05,370 --> 00:02:07,530 Now again, that normalization, that parsing, 55 55 00:02:07,530 --> 00:02:09,330 is going to help you get context. 56 56 00:02:09,330 --> 00:02:11,790 For instance, what if I had this log file 57 57 00:02:11,790 --> 00:02:14,190 which has all these different IP addresses? 58 58 00:02:14,190 --> 00:02:15,300 Is that useful? 59 59 00:02:15,300 --> 00:02:16,890 Well, maybe or maybe not. 60 60 00:02:16,890 --> 00:02:19,440 I need to correlate it and I need to normalize it first, 61 61 00:02:19,440 --> 00:02:21,120 so I understand the context of it. 62 62 00:02:21,120 --> 00:02:23,790 By knowing that these were IP addresses from a firewall 63 63 00:02:23,790 --> 00:02:25,950 that says what's going in or out of my network, 64 64 00:02:25,950 --> 00:02:27,060 that's helpful. 65 65 00:02:27,060 --> 00:02:29,190 Knowing if they're statically or dynamically assigned, 66 66 00:02:29,190 --> 00:02:30,240 that's helpful. 67 67 00:02:30,240 --> 00:02:33,000 Making sure the time of them matches all the other systems 68 68 00:02:33,000 --> 00:02:36,300 using UTC across my network, that's helpful. 69 69 00:02:36,300 --> 00:02:39,330 All of that correlates together to give me more information. 70 70 00:02:39,330 --> 00:02:41,250 Now, when we create these correlation rules, 71 71 00:02:41,250 --> 00:02:42,600 one of the important things to remember 72 72 00:02:42,600 --> 00:02:45,030 is that correlation rules match data 73 73 00:02:45,030 --> 00:02:47,280 as it's ingested into your SIEM, 74 74 00:02:47,280 --> 00:02:49,680 and this requires the data to stay in memory 75 75 00:02:49,680 --> 00:02:53,070 as persistent state data while you're trying to process it. 76 76 00:02:53,070 --> 00:02:55,200 So, for the example I had earlier of the three 77 77 00:02:55,200 --> 00:02:57,750 log-in failures within one hour, that means I have to 78 78 00:02:57,750 --> 00:03:01,710 maintain all the log-in data for up to one hour in memory. 79 79 00:03:01,710 --> 00:03:04,680 That stores a lot of information on my server in memory, 80 80 00:03:04,680 --> 00:03:06,450 and that can end up slowing down the system 81 81 00:03:06,450 --> 00:03:09,090 or causing it to crash if I have a large network. 82 82 00:03:09,090 --> 00:03:11,160 So there's got to be a better way to do these 83 83 00:03:11,160 --> 00:03:13,890 long-term searches across information. 84 84 00:03:13,890 --> 00:03:15,030 And there is! 85 85 00:03:15,030 --> 00:03:16,980 It's known as a SIEM query. 86 86 00:03:16,980 --> 00:03:19,770 Now, a SIEM query is going to extract records from among all 87 87 00:03:19,770 --> 00:03:23,520 the data stored for review or to show it as a visualization. 88 88 00:03:23,520 --> 00:03:26,880 Now, when we do this, we are going to go through the data store 89 89 00:03:26,880 --> 00:03:29,550 on the SIEM and find all the matching entries. 90 90 00:03:29,550 --> 00:03:31,440 Now, one of the big differences is with 91 91 00:03:31,440 --> 00:03:34,590 the correlation rules, it will flag an alert immediately. 92 92 00:03:34,590 --> 00:03:37,380 For the SIEM query, it waits until you run the query 93 93 00:03:37,380 --> 00:03:39,270 and look for that information. 94 94 00:03:39,270 --> 00:03:40,350 Now, when I look at a query, 95 95 00:03:40,350 --> 00:03:41,970 there's a couple of things we're going to look at. 96 96 00:03:41,970 --> 00:03:44,220 We are going to select some field 97 97 00:03:44,220 --> 00:03:48,360 where some conditions exist, sorted by some kind of field. 98 98 00:03:48,360 --> 00:03:49,710 And so what does this look like? 99 99 00:03:49,710 --> 00:03:52,320 Well, let's return to the last example we just had. 100 100 00:03:52,320 --> 00:03:54,869 Let's say we want select the user field where 101 101 00:03:54,869 --> 00:03:57,900 the error log-in failure is greater than three 102 102 00:03:57,900 --> 00:04:00,870 and the log-in failure for that user and the duration 103 103 00:04:00,870 --> 00:04:02,010 is less than one hour. 104 104 00:04:02,010 --> 00:04:03,540 If all those conditions are met, 105 105 00:04:03,540 --> 00:04:05,940 we are going to select that user, where they're going to provide 106 106 00:04:05,940 --> 00:04:08,670 that sorted list to us based on the date that it happened 107 107 00:04:08,670 --> 00:04:10,320 and the time that it happened. 108 108 00:04:10,320 --> 00:04:15,320 Now, this can go back minutes, hours, months, or even years. 109 109 00:04:15,390 --> 00:04:17,430 It depends on what you set your filters for. 110 110 00:04:17,430 --> 00:04:18,600 In this particular example, 111 111 00:04:18,600 --> 00:04:20,250 I am searching the entire database. 112 112 00:04:20,250 --> 00:04:23,550 Everything that's in my SIEM for as far back as it goes. 113 113 00:04:23,550 --> 00:04:25,470 And again, this is just another way to do this, 114 114 00:04:25,470 --> 00:04:27,810 and this is a query as opposed to a rule, 115 115 00:04:27,810 --> 00:04:30,180 because the rule is sitting there inside the where, 116 116 00:04:30,180 --> 00:04:32,400 but the query is what I'm searching, 117 117 00:04:32,400 --> 00:04:35,220 which is the where part of this, where I'm searching it, 118 118 00:04:35,220 --> 00:04:37,470 all of those users, and how I'm going to display it, 119 119 00:04:37,470 --> 00:04:38,643 what I'm sorting it by.