Instructor: IDS and IPS logs. 2 2
Now, in the last lesson, 3 3
we talked about the basics of an IDS and an IPS 4 4
and we even mentioned some software tools. 5 5
In this lesson, we are going to focus, 6 6
on the logs created by these tools. 7 7
Now a log entry is going to be created, 8 8
every time a rule is matched inside an IDS or an IPS. 9 9
Depending on your different configuration, 10 10
that rule can trigger an alert action 11 11
or perform a notification 12 12
or even block something because again, 13 13
if you're an IDS you also have the potential, 14 14
of being an IPS. 15 15
Now one of the biggest challenges, 16 16
when you start dealing with IDSs and IPSs is over-logging. 17 17
Because if you start getting so much data, 18 18
you can overwhelm yourself 19 19
and you're going to end up reducing the sensitivity, 20 20
of your analyst who's analyzing all this information, 21 21
as well as the tool itself. 22 22
So you want to make sure you get the tuning of it just right. 23 23
Another great thing about IDS and IPS software, 24 24
is that they provide you with a lot of different options, 25 25
for outputting your log entries. 26 26
Now, in the last lesson, we mentioned Snort, 27 27
as one of these IDS tools. 28 28
Let's take a look at some of the output formats, 29 29
that Snort provides. 30 30
There are five main formats. 31 31
The first is unified output 32 32
and this gives you a machine readable binary file, 33 33
but because it's machine readable, 34 34
you as a human can't read it. 35 35
If you want to read it, 36 36
you have to put it into an interpreter. 37 37
The second file format we can use is Syslog. 38 38
And this is the standard Syslog format, 39 39
that records event details like your IP address, 40 40
your port number and the ruler signature that was matched, 41 41
and it can be put into your standard siems 42 42
or into your syslog software, 43 43
so you can read it just like anything else. 44 44
Another format you could use is Comma separated values 45 45
or CSV. 46 46
This is a common data format, 47 47
that uses the comma character to delimit, 48 48
which fields and comments are going to be there. 49 49
This allows you to import it, 50 50
into any kind of third party application 51 51
or parse using regular expressions 52 52
or even open it as a spreadsheet in Excel or Google Sheets. 53 53
Another format you can use is TCP dump. 54 54
And this is actually a really useful one, 55 55
because it outputs things as a PCAP file. 56 56
Capturing all of the packets underlying that event. 57 57
So if we had a rule set up, 58 58
that we're trying to catch a bad guy doing something 59 59
and it fires, 60 60
it's going to start doing packet capture of that activity 61 61
and we can then later analyze it. 62 62
And finally, we can take all this data 63 63
and provide it as an input into a SIEM. 64 64
So we have a centralized repository, 65 65
of all of our different IDSs across the network, 66 66
as well as all of our other network appliances, 67 67
in one device that we as an analyst can look at. 68 68
Now, speaking of all these alerts 69 69
and everything that's going into the SIEM, 70 70
what do we do with all that? 71 71
Well, we have to monitor it. 72 72
All of these alerts need to be monitored in real time, 73 73
for us to be able to determine if an incident occurred. 74 74
Here on the screen, you can see an example, 75 75
from the Squeal tool inside of Security Onion. 76 76
This can be used to manage your different IDS alerts 77 77
and you can view all the triggering rules, 78 78
that underlie the packet data, 79 79
as well as looking at the packet itself here on the screen. 80 80
Now the great thing about this is it provides you, 81 81
one clean and easy graphical user interface, 82 82
for you to be able to see the logs, see the alert, 83 83
see the rules and see the packets underneath it. 84 84
This is one of the great things about using Security Onion, 85 85
it's got so many of these great tools that you can use 86 86
and they're already ready to go, 87 87
just waiting for you to use them. 88 88
Now, all these alerts are actually created in your logs, 89 89
by a rule. 90 90
Now, let's talk a little bit about these rules. 91 91
Because as an analyst, you can actually create custom rules, 92 92
for your specific organizational needs as well. 93 93
By default, I said there were community rules, 94 94
that other people wrote. 95 95
There are subscription feeds, 96 96
with rules that come from researchers, 97 97
that have all the latest and greatest. 98 98
But sometimes you need to create a custom rule, 99 99
because you want to look for something specific 100 100
or maybe an existing rule is too sensitive 101 101
or not sensitive enough. 102 102
By being able to read a rule and change it, 103 103
you can customize it for your own needs. 104 104
Now, each IDS uses its own format, 105 105
but one of the most common is the Snort rule format. 106 106
The Snort rule format looks like this. 107 107
You have the action, a protocol, a source IP, 108 108
a source port, a direction, 109 109
a destination IP, a destination port 110 110
and then all of the different rules that you're looking for. 111 111
Now, this again, is a generic format. 112 112
But we can look at how this actually looks, 113 113
as we go through each section of this. 114 114
First we have our action field. 115 115
This is usually going to be set to alert, 116 116
but there's other options too. 117 117
You can say you want to log it, pass it, which means ignore, 118 118
drop it like if you're an IPS 119 119
or reject it if you're an IPS. 120 120
Then we have our source and destination addresses and ports 121 121
and these are usually going to be set to a keyword like any, 122 122
saying any destination or any source or any port 123 123
or you can set it to a variable, 124 124
like external net meaning it's an external network 125 125
or your home net the network that you have, 126 126
your internal network. 127 127
But you can also use a static value. 128 128
For instance, maybe I want to see all web traffic, 129 129
so I'm going to look for port 80, 130 130
instead of just saying any. 131 131
The next area we have to look at is our direction. 132 132
Is the traffic coming inbound or outbound, 133 133
which would be unidirectional, one direction 134 134
or both ways, bidirectional. 135 135
And we do this by using the symbols, 136 136
you see here on the screen with a dash and a greater then 137 137
or the less than and greater than symbols together, 138 138
for bidirectional. 139 139
And then that brings us to our rule options 140 140
and you'll notice that in the example I showed you, 141 141
it said rule option, semicolon, 142 142
rule option, semicolon, dot, dot, dot. 143 143
That's because there are so many different rule options, 144 144
that you can set within snort. 145 145
You can set ones like MSG, which is message. 146 146
Which is text to inform the responder, 147 147
what triggered the rule, basically like a comment. 148 148
You can set it for flow. 149 149
Flow is going to match a newer existing TCP connection 150 150
or match regardless of the TCP connection state. 151 151
You might have flags. 152 152
Flags will tell you whether to match flags in the packet, 153 153
such as the TCP sin, the fin, the reset or things like that. 154 154
You also can have track. 155 155
Track is going to apply a rate limiter to the rule, 156 156
by only triggering if the threshold of events, 157 157
pass over a certain duration. 158 158
For instance, if this bad guy comes in once every minute, 159 159
then flag it. 160 160
If he comes in once every hour, we'll ignore it, 161 161
something like that. 162 162
Then we have reference. 163 163
Reference would be able to match an entry, 164 164
to an attack database. 165 165
For instance you might want to have it, 166 166
match the mitre attack database 167 167
and so you'd have an ID number that matches that. 168 168
Then we have class type. 169 169
Class type is going to categorize the attack. 170 170
Is this a brute force? 171 171
Is this a denial of service? 172 172
What kind of attack are we looking at? 173 173
And then we look at sid and Rev. 174 174
Now this is going to be an ID rule, a snort id, which is sid 175 175
or it's going to be rev, which is the version, 176 176
the revision number of that rule. 177 177
And this is all put together 178 178
and it looks something like this. 179 179
Here's an example of a snort rule, 180 180
for a brute force attempt against an IMAP mailbox account. 181 181
First, what are we going to do? 182 182
We're going to alert if this rule fires. 183 183
And then what is it going to be looking for? 184 184
It's looking for TCP traffic. 185 185
Now, where is it coming from? 186 186
Anything coming from the external network on any port. 187 187
And we're going to use the direction inbound, 188 188
going towards our home network or our internal network. 189 189
And if it's going to our internal network on port 143, 190 190
that would say we are going to go ahead and alert on this. 191 191
Now what does the message here? 192 192
Well, if we have that alert happen, 193 193
we are going to give the message of protocol IMAP login, 194 194
brute force attempt, 195 195
which basically is a comment telling me the analyst, 196 196
that's what I'm trying to do here. 197 197
Then we're going to look at the flow. 198 198
This is another option. 199 199
The flow is going to the server, 200 200
it's using the established and it has no stream. 201 201
Then we're going to look at content. 202 202
The content is log on, meaning it's trying a login attempt. 203 203
Then we're going to look at the fast pattern only, 204 204
which means we only want to look at fast patterns. 205 205
Then we'll look at detection filter, 206 206
which is track by destination count 30 and 30 seconds. 207 207
This again goes back to, 208 208
how long do we want this thing to do it? 209 209
It's the rate limiter essentially. 210 210
So basically we're looking at, 211 211
if they try to log in 30 times within 30 seconds, 212 212
we consider that a brute force attempt. 213 213
But if they try to log in 30 times, within 30 minutes, 214 214
it wouldn't be, and we wouldn't fire this alert. 215 215
Next we have metadata 216 216
and in this case the metadata, 217 217
is the rules that came from the community 218 218
and it's for the service of IMAP. 219 219
This is just some information for us to know, 220 220
some keywords as we're looking for some kind of a signature. 221 221
And then we have our reference. 222 222
Now this is going towards the mitre attack 223 223
and it gives us the URL for the exact technique. 224 224
So if you went to your web browser 225 225
and typed in attack dot mitre dot org slash techniques, 226 226
slash T 1110 that would actually give you information, 227 227
about this type of attack 228 228
and that's what we're referencing here. 229 229
Then we go to class type 230 230
and class type is a suspicious login. 231 231
That's what we're going to classify this signature as. 232 232
And then we have our ID, which is 2273, and our revision, 233 233
this is the 12th version of this particular signature. 234 234
That's how all of this goes together, 235 235
when you look at one of these snort rules. 236 236
Now for the exam, you don't need to be a snort expert. 237 237
But you should be able to read and understand a rule, 238 238
if you're given one on exam day. 239 239
They're not going to ask you, 240 240
to create a custom rule on the exam 241 241
and write all that from scratch, 242 242
although you do need to be able to do that kind of thing, 243 243
in the real world as a cybersecurity analyst. 244 244
But just being able to read a simple rule, 245 245
like the one I gave you here and be able to pick out, 246 246
some important pieces of information, 247 247
like the action type, 248 248
the source or destination address or port 249 249
and things like that is going to be really useful for you, 250 250
on the exam.