1 1 00:00:00,257 --> 00:00:03,120 IDS and IPS logs. 2 2 00:00:03,120 --> 00:00:04,260 Now, in the last lesson, 3 3 00:00:04,260 --> 00:00:07,230 we talked about the basics of an IDS and an IPS 4 4 00:00:07,230 --> 00:00:09,300 and we even mentioned some software tools. 5 5 00:00:09,300 --> 00:00:10,830 In this lesson, we are going to focus, 6 6 00:00:10,830 --> 00:00:12,596 on the logs created by these tools. 7 7 00:00:12,596 --> 00:00:14,760 Now a log entry is going to be created, 8 8 00:00:14,760 --> 00:00:18,990 every time a rule is matched inside an IDS or an IPS. 9 9 00:00:18,990 --> 00:00:20,550 Depending on your different configuration, 10 10 00:00:20,550 --> 00:00:22,410 that rule can trigger an alert action 11 11 00:00:22,410 --> 00:00:24,060 or perform a notification 12 12 00:00:24,060 --> 00:00:25,950 or even block something because again, 13 13 00:00:25,950 --> 00:00:27,630 if you're an IDS you also have the potential, 14 14 00:00:27,630 --> 00:00:29,014 of being an IPS. 15 15 00:00:29,014 --> 00:00:31,110 Now one of the biggest challenges, 16 16 00:00:31,110 --> 00:00:35,040 when you start dealing with IDSs and IPSs is over-logging. 17 17 00:00:35,040 --> 00:00:37,590 Because if you start getting so much data, 18 18 00:00:37,590 --> 00:00:38,931 you can overwhelm yourself 19 19 00:00:38,931 --> 00:00:41,220 and you're going to end up reducing the sensitivity, 20 20 00:00:41,220 --> 00:00:43,590 of your analyst who's analyzing all this information, 21 21 00:00:43,590 --> 00:00:45,300 as well as the tool itself. 22 22 00:00:45,300 --> 00:00:48,004 So you want to make sure you get the tuning of it just right. 23 23 00:00:48,004 --> 00:00:51,180 Another great thing about IDS and IPS software, 24 24 00:00:51,180 --> 00:00:53,400 is that they provide you with a lot of different options, 25 25 00:00:53,400 --> 00:00:55,320 for outputting your log entries. 26 26 00:00:55,320 --> 00:00:57,150 Now, in the last lesson, we mentioned Snort, 27 27 00:00:57,150 --> 00:00:58,710 as one of these IDS tools. 28 28 00:00:58,710 --> 00:01:00,420 Let's take a look at some of the output formats, 29 29 00:01:00,420 --> 00:01:01,680 that Snort provides. 30 30 00:01:01,680 --> 00:01:03,510 There are five main formats. 31 31 00:01:03,510 --> 00:01:05,400 The first is unified output 32 32 00:01:05,400 --> 00:01:08,100 and this gives you a machine readable binary file, 33 33 00:01:08,100 --> 00:01:09,600 but because it's machine readable, 34 34 00:01:09,600 --> 00:01:11,130 you as a human can't read it. 35 35 00:01:11,130 --> 00:01:11,963 If you want to read it, 36 36 00:01:11,963 --> 00:01:13,463 you have to put it into an interpreter. 37 37 00:01:13,463 --> 00:01:16,380 The second file format we can use is Syslog. 38 38 00:01:16,380 --> 00:01:18,270 And this is the standard Syslog format, 39 39 00:01:18,270 --> 00:01:20,610 that records event details like your IP address, 40 40 00:01:20,610 --> 00:01:23,160 your port number and the ruler signature that was matched, 41 41 00:01:23,160 --> 00:01:25,350 and it can be put into your standard siems 42 42 00:01:25,350 --> 00:01:27,150 or into your syslog software, 43 43 00:01:27,150 --> 00:01:29,340 so you can read it just like anything else. 44 44 00:01:29,340 --> 00:01:31,920 Another format you could use is Comma separated values 45 45 00:01:31,920 --> 00:01:33,240 or CSV. 46 46 00:01:33,240 --> 00:01:34,920 This is a common data format, 47 47 00:01:34,920 --> 00:01:37,080 that uses the comma character to delimit, 48 48 00:01:37,080 --> 00:01:39,150 which fields and comments are going to be there. 49 49 00:01:39,150 --> 00:01:40,170 This allows you to import it, 50 50 00:01:40,170 --> 00:01:41,984 into any kind of third party application 51 51 00:01:41,984 --> 00:01:44,280 or parse using regular expressions 52 52 00:01:44,280 --> 00:01:47,877 or even open it as a spreadsheet in Excel or Google Sheets. 53 53 00:01:47,877 --> 00:01:50,820 Another format you can use is TCP dump. 54 54 00:01:50,820 --> 00:01:52,350 And this is actually a really useful one, 55 55 00:01:52,350 --> 00:01:54,900 because it outputs things as a PCAP file. 56 56 00:01:54,900 --> 00:01:58,080 Capturing all of the packets underlying that event. 57 57 00:01:58,080 --> 00:01:59,310 So if we had a rule set up, 58 58 00:01:59,310 --> 00:02:01,348 that we're trying to catch a bad guy doing something 59 59 00:02:01,348 --> 00:02:02,700 and it fires, 60 60 00:02:02,700 --> 00:02:05,250 it's going to start doing packet capture of that activity 61 61 00:02:05,250 --> 00:02:07,200 and we can then later analyze it. 62 62 00:02:07,200 --> 00:02:09,000 And finally, we can take all this data 63 63 00:02:09,000 --> 00:02:10,920 and provide it as an input into a SIEM. 64 64 00:02:10,920 --> 00:02:12,750 So we have a centralized repository, 65 65 00:02:12,750 --> 00:02:15,120 of all of our different IDSs across the network, 66 66 00:02:15,120 --> 00:02:17,100 as well as all of our other network appliances, 67 67 00:02:17,100 --> 00:02:19,662 in one device that we as an analyst can look at. 68 68 00:02:19,662 --> 00:02:21,630 Now, speaking of all these alerts 69 69 00:02:21,630 --> 00:02:23,010 and everything that's going into the SIEM, 70 70 00:02:23,010 --> 00:02:24,420 what do we do with all that? 71 71 00:02:24,420 --> 00:02:26,220 Well, we have to monitor it. 72 72 00:02:26,220 --> 00:02:29,010 All of these alerts need to be monitored in real time, 73 73 00:02:29,010 --> 00:02:31,800 for us to be able to determine if an incident occurred. 74 74 00:02:31,800 --> 00:02:33,630 Here on the screen, you can see an example, 75 75 00:02:33,630 --> 00:02:36,083 from the Squeal tool inside of Security Onion. 76 76 00:02:36,083 --> 00:02:38,815 This can be used to manage your different IDS alerts 77 77 00:02:38,815 --> 00:02:40,800 and you can view all the triggering rules, 78 78 00:02:40,800 --> 00:02:42,540 that underlie the packet data, 79 79 00:02:42,540 --> 00:02:46,110 as well as looking at the packet itself here on the screen. 80 80 00:02:46,110 --> 00:02:48,180 Now the great thing about this is it provides you, 81 81 00:02:48,180 --> 00:02:50,733 one clean and easy graphical user interface, 82 82 00:02:50,733 --> 00:02:53,430 for you to be able to see the logs, see the alert, 83 83 00:02:53,430 --> 00:02:55,802 see the rules and see the packets underneath it. 84 84 00:02:55,802 --> 00:02:58,410 This is one of the great things about using Security Onion, 85 85 00:02:58,410 --> 00:03:00,297 it's got so many of these great tools that you can use 86 86 00:03:00,297 --> 00:03:02,040 and they're already ready to go, 87 87 00:03:02,040 --> 00:03:03,671 just waiting for you to use them. 88 88 00:03:03,671 --> 00:03:06,960 Now, all these alerts are actually created in your logs, 89 89 00:03:06,960 --> 00:03:07,938 by a rule. 90 90 00:03:07,938 --> 00:03:10,080 Now, let's talk a little bit about these rules. 91 91 00:03:10,080 --> 00:03:12,931 Because as an analyst, you can actually create custom rules, 92 92 00:03:12,931 --> 00:03:15,708 for your specific organizational needs as well. 93 93 00:03:15,708 --> 00:03:18,210 By default, I said there were community rules, 94 94 00:03:18,210 --> 00:03:19,380 that other people wrote. 95 95 00:03:19,380 --> 00:03:20,550 There are subscription feeds, 96 96 00:03:20,550 --> 00:03:22,350 with rules that come from researchers, 97 97 00:03:22,350 --> 00:03:24,000 that have all the latest and greatest. 98 98 00:03:24,000 --> 00:03:26,580 But sometimes you need to create a custom rule, 99 99 00:03:26,580 --> 00:03:28,701 because you want to look for something specific 100 100 00:03:28,701 --> 00:03:31,350 or maybe an existing rule is too sensitive 101 101 00:03:31,350 --> 00:03:32,820 or not sensitive enough. 102 102 00:03:32,820 --> 00:03:34,800 By being able to read a rule and change it, 103 103 00:03:34,800 --> 00:03:36,998 you can customize it for your own needs. 104 104 00:03:36,998 --> 00:03:39,780 Now, each IDS uses its own format, 105 105 00:03:39,780 --> 00:03:42,176 but one of the most common is the Snort rule format. 106 106 00:03:42,176 --> 00:03:44,627 The Snort rule format looks like this. 107 107 00:03:44,627 --> 00:03:48,330 You have the action, a protocol, a source IP, 108 108 00:03:48,330 --> 00:03:50,340 a source port, a direction, 109 109 00:03:50,340 --> 00:03:52,890 a destination IP, a destination port 110 110 00:03:52,890 --> 00:03:55,432 and then all of the different rules that you're looking for. 111 111 00:03:55,432 --> 00:03:57,852 Now, this again, is a generic format. 112 112 00:03:57,852 --> 00:04:00,000 But we can look at how this actually looks, 113 113 00:04:00,000 --> 00:04:01,596 as we go through each section of this. 114 114 00:04:01,596 --> 00:04:03,479 First we have our action field. 115 115 00:04:03,479 --> 00:04:05,850 This is usually going to be set to alert, 116 116 00:04:05,850 --> 00:04:07,230 but there's other options too. 117 117 00:04:07,230 --> 00:04:10,470 You can say you want to log it, pass it, which means ignore, 118 118 00:04:10,470 --> 00:04:12,390 drop it like if you're an IPS 119 119 00:04:12,390 --> 00:04:14,343 or reject it if you're an IPS. 120 120 00:04:14,343 --> 00:04:17,580 Then we have our source and destination addresses and ports 121 121 00:04:17,580 --> 00:04:20,340 and these are usually going to be set to a keyword like any, 122 122 00:04:20,340 --> 00:04:23,630 saying any destination or any source or any port 123 123 00:04:23,630 --> 00:04:25,470 or you can set it to a variable, 124 124 00:04:25,470 --> 00:04:28,200 like external net meaning it's an external network 125 125 00:04:28,200 --> 00:04:30,480 or your home net the network that you have, 126 126 00:04:30,480 --> 00:04:31,800 your internal network. 127 127 00:04:31,800 --> 00:04:33,930 But you can also use a static value. 128 128 00:04:33,930 --> 00:04:36,300 For instance, maybe I want to see all web traffic, 129 129 00:04:36,300 --> 00:04:37,920 so I'm going to look for port 80, 130 130 00:04:37,920 --> 00:04:39,945 instead of just saying any. 131 131 00:04:39,945 --> 00:04:42,690 The next area we have to look at is our direction. 132 132 00:04:42,690 --> 00:04:44,910 Is the traffic coming inbound or outbound, 133 133 00:04:44,910 --> 00:04:47,100 which would be unidirectional, one direction 134 134 00:04:47,100 --> 00:04:49,260 or both ways, bidirectional. 135 135 00:04:49,260 --> 00:04:50,760 And we do this by using the symbols, 136 136 00:04:50,760 --> 00:04:53,580 you see here on the screen with a dash and a greater then 137 137 00:04:53,580 --> 00:04:56,100 or the less than and greater than symbols together, 138 138 00:04:56,100 --> 00:04:57,276 for bidirectional. 139 139 00:04:57,276 --> 00:04:59,670 And then that brings us to our rule options 140 140 00:04:59,670 --> 00:05:01,800 and you'll notice that in the example I showed you, 141 141 00:05:01,800 --> 00:05:03,720 it said rule option, semicolon, 142 142 00:05:03,720 --> 00:05:06,240 rule option, semicolon, dot, dot, dot. 143 143 00:05:06,240 --> 00:05:08,460 That's because there are so many different rule options, 144 144 00:05:08,460 --> 00:05:09,946 that you can set within snort. 145 145 00:05:09,946 --> 00:05:13,560 You can set ones like MSG, which is message. 146 146 00:05:13,560 --> 00:05:15,210 Which is text to inform the responder, 147 147 00:05:15,210 --> 00:05:17,785 what triggered the rule, basically like a comment. 148 148 00:05:17,785 --> 00:05:19,322 You can set it for flow. 149 149 00:05:19,322 --> 00:05:22,299 Flow is going to match a newer existing TCP connection 150 150 00:05:22,299 --> 00:05:25,388 or match regardless of the TCP connection state. 151 151 00:05:25,388 --> 00:05:26,801 You might have flags. 152 152 00:05:26,801 --> 00:05:29,610 Flags will tell you whether to match flags in the packet, 153 153 00:05:29,610 --> 00:05:33,828 such as the TCP sin, the fin, the reset or things like that. 154 154 00:05:33,828 --> 00:05:35,326 You also can have track. 155 155 00:05:35,326 --> 00:05:37,950 Track is going to apply a rate limiter to the rule, 156 156 00:05:37,950 --> 00:05:40,200 by only triggering if the threshold of events, 157 157 00:05:40,200 --> 00:05:42,150 pass over a certain duration. 158 158 00:05:42,150 --> 00:05:45,540 For instance, if this bad guy comes in once every minute, 159 159 00:05:45,540 --> 00:05:46,373 then flag it. 160 160 00:05:46,373 --> 00:05:48,750 If he comes in once every hour, we'll ignore it, 161 161 00:05:48,750 --> 00:05:49,716 something like that. 162 162 00:05:49,716 --> 00:05:51,120 Then we have reference. 163 163 00:05:51,120 --> 00:05:52,950 Reference would be able to match an entry, 164 164 00:05:52,950 --> 00:05:54,210 to an attack database. 165 165 00:05:54,210 --> 00:05:55,710 For instance you might want to have it, 166 166 00:05:55,710 --> 00:05:57,284 match the mitre attack database 167 167 00:05:57,284 --> 00:05:59,718 and so you'd have an ID number that matches that. 168 168 00:05:59,718 --> 00:06:01,118 Then we have class type. 169 169 00:06:01,118 --> 00:06:03,450 Class type is going to categorize the attack. 170 170 00:06:03,450 --> 00:06:04,650 Is this a brute force? 171 171 00:06:04,650 --> 00:06:06,060 Is this a denial of service? 172 172 00:06:06,060 --> 00:06:07,614 What kind of attack are we looking at? 173 173 00:06:07,614 --> 00:06:10,170 And then we look at sid and Rev. 174 174 00:06:10,170 --> 00:06:13,740 Now this is going to be an ID rule, a snort id, which is sid 175 175 00:06:13,740 --> 00:06:15,630 or it's going to be rev, which is the version, 176 176 00:06:15,630 --> 00:06:17,460 the revision number of that rule. 177 177 00:06:17,460 --> 00:06:18,930 And this is all put together 178 178 00:06:18,930 --> 00:06:20,465 and it looks something like this. 179 179 00:06:20,465 --> 00:06:22,650 Here's an example of a snort rule, 180 180 00:06:22,650 --> 00:06:25,732 for a brute force attempt against an IMAP mailbox account. 181 181 00:06:25,732 --> 00:06:27,690 First, what are we going to do? 182 182 00:06:27,690 --> 00:06:29,514 We're going to alert if this rule fires. 183 183 00:06:29,514 --> 00:06:31,920 And then what is it going to be looking for? 184 184 00:06:31,920 --> 00:06:33,840 It's looking for TCP traffic. 185 185 00:06:33,840 --> 00:06:35,442 Now, where is it coming from? 186 186 00:06:35,442 --> 00:06:39,390 Anything coming from the external network on any port. 187 187 00:06:39,390 --> 00:06:41,370 And we're going to use the direction inbound, 188 188 00:06:41,370 --> 00:06:44,580 going towards our home network or our internal network. 189 189 00:06:44,580 --> 00:06:47,391 And if it's going to our internal network on port 143, 190 190 00:06:47,391 --> 00:06:50,409 that would say we are going to go ahead and alert on this. 191 191 00:06:50,409 --> 00:06:52,590 Now what does the message here? 192 192 00:06:52,590 --> 00:06:54,270 Well, if we have that alert happen, 193 193 00:06:54,270 --> 00:06:57,090 we are going to give the message of protocol IMAP login, 194 194 00:06:57,090 --> 00:06:58,110 brute force attempt, 195 195 00:06:58,110 --> 00:07:00,240 which basically is a comment telling me the analyst, 196 196 00:07:00,240 --> 00:07:01,640 that's what I'm trying to do here. 197 197 00:07:01,640 --> 00:07:03,210 Then we're going to look at the flow. 198 198 00:07:03,210 --> 00:07:04,260 This is another option. 199 199 00:07:04,260 --> 00:07:06,030 The flow is going to the server, 200 200 00:07:06,030 --> 00:07:08,563 it's using the established and it has no stream. 201 201 00:07:08,563 --> 00:07:10,470 Then we're going to look at content. 202 202 00:07:10,470 --> 00:07:13,886 The content is log on, meaning it's trying a login attempt. 203 203 00:07:13,886 --> 00:07:16,680 Then we're going to look at the fast pattern only, 204 204 00:07:16,680 --> 00:07:18,576 which means we only want to look at fast patterns. 205 205 00:07:18,576 --> 00:07:20,580 Then we'll look at detection filter, 206 206 00:07:20,580 --> 00:07:24,780 which is track by destination count 30 and 30 seconds. 207 207 00:07:24,780 --> 00:07:26,280 This again goes back to, 208 208 00:07:26,280 --> 00:07:27,900 how long do we want this thing to do it? 209 209 00:07:27,900 --> 00:07:29,548 It's the rate limiter essentially. 210 210 00:07:29,548 --> 00:07:30,870 So basically we're looking at, 211 211 00:07:30,870 --> 00:07:33,570 if they try to log in 30 times within 30 seconds, 212 212 00:07:33,570 --> 00:07:35,490 we consider that a brute force attempt. 213 213 00:07:35,490 --> 00:07:37,950 But if they try to log in 30 times, within 30 minutes, 214 214 00:07:37,950 --> 00:07:40,620 it wouldn't be, and we wouldn't fire this alert. 215 215 00:07:40,620 --> 00:07:42,000 Next we have metadata 216 216 00:07:42,000 --> 00:07:43,110 and in this case the metadata, 217 217 00:07:43,110 --> 00:07:45,060 is the rules that came from the community 218 218 00:07:45,060 --> 00:07:46,500 and it's for the service of IMAP. 219 219 00:07:46,500 --> 00:07:48,300 This is just some information for us to know, 220 220 00:07:48,300 --> 00:07:50,574 some keywords as we're looking for some kind of a signature. 221 221 00:07:50,574 --> 00:07:52,140 And then we have our reference. 222 222 00:07:52,140 --> 00:07:53,880 Now this is going towards the mitre attack 223 223 00:07:53,880 --> 00:07:56,359 and it gives us the URL for the exact technique. 224 224 00:07:56,359 --> 00:07:58,020 So if you went to your web browser 225 225 00:07:58,020 --> 00:08:01,590 and typed in attack dot mitre dot org slash techniques, 226 226 00:08:01,590 --> 00:08:05,550 slash T 1110 that would actually give you information, 227 227 00:08:05,550 --> 00:08:07,230 about this type of attack 228 228 00:08:07,230 --> 00:08:08,796 and that's what we're referencing here. 229 229 00:08:08,796 --> 00:08:10,680 Then we go to class type 230 230 00:08:10,680 --> 00:08:12,720 and class type is a suspicious login. 231 231 00:08:12,720 --> 00:08:15,118 That's what we're going to classify this signature as. 232 232 00:08:15,118 --> 00:08:18,990 And then we have our ID, which is 2273, and our revision, 233 233 00:08:18,990 --> 00:08:21,778 this is the 12th version of this particular signature. 234 234 00:08:21,778 --> 00:08:23,670 That's how all of this goes together, 235 235 00:08:23,670 --> 00:08:25,313 when you look at one of these snort rules. 236 236 00:08:25,313 --> 00:08:28,860 Now for the exam, you don't need to be a snort expert. 237 237 00:08:28,860 --> 00:08:31,170 But you should be able to read and understand a rule, 238 238 00:08:31,170 --> 00:08:33,030 if you're given one on exam day. 239 239 00:08:33,030 --> 00:08:33,870 They're not going to ask you, 240 240 00:08:33,870 --> 00:08:35,460 to create a custom rule on the exam 241 241 00:08:35,460 --> 00:08:37,140 and write all that from scratch, 242 242 00:08:37,140 --> 00:08:39,270 although you do need to be able to do that kind of thing, 243 243 00:08:39,270 --> 00:08:41,700 in the real world as a cybersecurity analyst. 244 244 00:08:41,700 --> 00:08:43,680 But just being able to read a simple rule, 245 245 00:08:43,680 --> 00:08:45,810 like the one I gave you here and be able to pick out, 246 246 00:08:45,810 --> 00:08:47,250 some important pieces of information, 247 247 00:08:47,250 --> 00:08:48,248 like the action type, 248 248 00:08:48,248 --> 00:08:51,180 the source or destination address or port 249 249 00:08:51,180 --> 00:08:53,490 and things like that is going to be really useful for you, 250 250 00:08:53,490 --> 00:08:54,393 on the exam.