In this lesson,
we're going to cover security information
and event management systems.
Now, log reviews are a critical part of security assurance,
but to perform this effectively, we really need
to first gather all of our logs from our different systems
on our network and put them all into one place.
Now, gathering your system logs is important,
but gathering those logs will do you no good
if you don't actually take time to look at those logs.
Your log should not just be reviewed
after an incident occurs.
Instead, you shouldn't just be using them as part
of your instant response, but you should really be looking
at those logs regularly
and routinely as part of your alerting
and monitoring activities.
To do this effectively though, you really do need
to have them all in one place,
and that is why we'll be using a SIEM.
Now, a SIEM or a security information
and event management system is a solution
that provides real-time or near real-time analysis
of your security alerts that are being generated
by network hardware and applications.
As we look at a SIEM, there's a lot of uses for them,
but one of the best things that we use them for
is to help us correlate all these various events and logs
and incidents into one central place.
Now, let's pretend for a moment that you're working
as a cybersecurity analyst or professional,
and you've been asked to go over all the system logs
to detect any kind of unusual activities.
Now, as you begin to look through all those logs,
you start seeing that somebody has logged in from a VPN
from Asia using the account for Mr. John Smith.
Now, if John Smith is one of our employees
and he's currently on a business trip to Asia,
then there's probably nothing wrong
with him logging in using a VPN from Asia.
But if you see another log entry just a few minutes later
that shows John Smith's security badge was used
to unlock the server room door in your data center located
in New York City, this is a big issue
because John Smith can't be in both the server room
in New York City and connecting back
to the network using a VPN from a hotel in Asia.
These two things can't happen at the same time,
so based on these two log entries, we know that one
of these two things is wrong or suspicious or malicious,
but we don't know which one it is yet.
Now, in this case, John is an authorized employee,
so his logging into the VPN or going in
and accessing the server room in itself is fine,
but putting those two things together at the same time
as being correlated within a short period of time flags them
as something we need to look into further and investigate
because this person can't be
in both places at the same time.
Now, since these are two disparate systems
with one being the VPN system
and one being the physical security system
for your data center,
you likely wouldn't have noticed this correlation
across both sets of logs
unless you were using a SIEM, which can then consolidate
and correlate all of your system logs
into the centralized database or repository
because with the SIEM, it's now relatively quick
and easy for us to identify this type
of impossible travel across both of these disparate systems.
Now, another example might involve a large enterprise
with a complex network infrastructure
that includes multiple servers, databases, firewalls,
and thousands upon thousands of workstations.
This organization may deploy a SIEM system
to monitor and analyze activities across all these devices
for any kind of potential security threats too,
and this is another place where a SIEM helps us out.
Now, the SIEM will be able to collect log data
from all these different disparate sources
and aggregate it all together for analysis
by a cybersecurity professional.
The SIEM can then correlate
and analyze this data to identify patterns
that might indicate a security threat,
such as repeated login failures, unusual data transfers,
or changes in file permissions.
If the SIEM is going to detect a potential security threat,
it can then generate an alert for the security team
to come and investigate it.
This can also provide us additional detailed information
about the threat, such as the source of the attack,
the systems or data it's targeting,
and the methods it's using to be able
to help our security team respond more quickly
and more effectively.
Now, a security and information event management system,
or SIEM, can also be implemented
in a couple of different ways.
You can do this as software, hardware appliances,
or even as an outsourced managed service
when you're using a SIEM.
Your SIEM can also be either agent based
or agentless depending on how you want to collect the log data
from all of your network devices
and systems across that network.
Now, an agent is a small piece of software
that's going to be installed on each system, such as a server
or workstation from which the SIEM needs
to gather and collect log data.
The agent will collect the log data
and then send it back to the SIEM system
for processing and correlation.
This approach provides real-time data collection
and can collect more detailed information,
but it does require installing
and maintaining the software agent on each of those systems.
Other SIEMs though may rely on what's known
as an agentless installation.
Under this approach, the SIEM system
will directly collect log data
from each system using a standard protocol like SNMP or WMI.
Now, this approach doesn't require installing any software
in the systems,
which can reduce your overall maintenance costs.
However, it may not provide as detailed of information
as an agent-based approach would,
and it may not be able to collect data in near real-time
like you can with an agent-based system.
Now, to effectively deploy a SIEM,
you have to consider a lot of different things.
First, you need to be able to log all the relevant events
and filter out anything that is not considered
to be relevant because we consider
that to be irrelevant data and we don't want to look at it.
Second, we need to make sure that we can establish
and document the scope of the events inside of our SIEM.
Exactly what are we going to be logging
and what's going to be considered inside
or outside of our scope?
Third, we need to develop use cases
to define what a threat is.
This helps you define exactly what you do
and what you do not consider to be a threat,
and then what actions you may
or may not take based on that threat.
This brings us to item number four where you need
to plan out your incident response actions
for a given threat or a given event.
Basically, you need to know that when you see this type
of thing happening and alerting,
what are the actions you want your team to take?
That's what we're talking about here.
It's the pre-planned responses for any kind of given threat
that you may end up facing out in the real world.
Fifth, we need to establish a ticketing process.
That way we could track all these different events
that we're flagging.
This way, as we go into our SIEM, we may see something
that's unusual, like my example earlier when we saw somebody
logging in from Asia and logging at the local office
at the same time.
We would say that looks suspicious, so we will flag it.
Now, once we flag it, we need to have some sort
of a ticketing system created so we can be able
to track it all the way through the process
to make sure nobody drops it
and it doesn't get forgotten about.
Sixth, we need to schedule regular threat hunting.
Now, by doing this, we want to ensure
that we're not missing any important events
that may have escaped an alert.
By setting up and conducting threat hunting,
we're going to be able to catch bad actors doing bad things
that may have bypassed our alerts.
And finally, we move into our seventh item that we need
to consider, which is to provide auditors
and analysts an evidence trail.
As you probably guessed by now,
a SIEM is a centralized repository that has lots
of different data, so it becomes a great place for auditors
and analysts to look through as they begin
to do their analysis for your compliance reports.
Now, there's a lot of different SIEM solutions out there,
including both commercial and open source varieties
that includes things like Splunk, ELK,
or the Elastic Stack, ArcSight and QRadar.
If you hear any of these names,
you should know they have the ability to act as a SIEM,
but beyond that, you really don't need
to know how to use them or operate them for your exam.
Now, like I said, there's a lot of open source tools
that make a great addition to your own practice labs
and your own home network
because if you're building out your own home network,
this will give you the experience
with these tools hands-on,
which in turn makes you a much better analyst
out in the real world,
and so that's a reason why it's important
to look at these different SIEMs
and maybe even play with them in your own network.
Now, let's take a look at some
of these different SIEMs and understand what they are.
First, we have Splunk.
Now, Splunk is a market-leading
big data information-gathering and analysis tool
that can import machine-generated data via a connector
or a visibility add-on.
Now, Splunk is really good at connecting lots
of different data systems and sources
into one consolidated area.
In fact, it has different connectors built
for most network operating systems
and different application formats as well.
Essentially, all the data from all these different systems
can be indexed as it's taken off of those systems
and then written into a centralized database store
using a common format.
This allows Splunk to be able to go
through all the historical or real-time data
and be able to search through all
of it using its proprietary search algorithms
called the Search Processing Language.
Now, once you get those results,
you can start visualizing it using different tools.
So if you're using Splunk, it looks something like this.
Notice here what I have is what looks like a dashboard
and I can see all my important information in one place.
I see I have lots of data, I see trends going up or down.
I see events over time, and I can actually drill down
and click into each one of those by going in
and look at the data behind it as well if I need to.
Now, Splunk is a really great tool
and it can be installed locally
or as a cloud-based solution.
When you buy Splunk, it comes with a lot of templates
and pre-configured dashboards,
as well as security intelligence searches
and incident response workflows.
Splunk is probably one of the biggest players
in the marketplace,
and it's a great SIEM for you to consider.
Second, we have ELK or the Elastic Stack.
Now, ELK or the Elastic Stack is a collection of free
and open source SIEM tools that provide storage, search,
and analysis functions.
Now, with Elk and Elastic Stack, it's actually made up
of four different components.
These are the Elasticsearch, which covers the query
and analytics, Logstash, which is your log collection
and normalization process, Kibana,
which does your visualization
and Beats, which is your endpoint collection agents
that are installed on your machines.
The way these all work together
is that you're going to have different beats installed
on different servers or hosts,
and they can then send out either directly things back
to Elastic Stack, or it can go into Logstash first.
Now, when it goes into Log Stash first,
it's going to be doing all the parsing
and normalization for you,
and then it sends it over to the Elasticsearch.
If you go directly into Elasticsearch,
it has to be in a format that it already understands.
Now, Elasticsearch is that centralized data store,
and you're really not going to go in
and look at Elastic itself to look at the data.
Instead, most of the time,
you're going to use a visualization tool like Kibana.
Kibana goes into Elastic,
and then visualizes all the data in a way that makes it easy
for us to see and understand.
Just like Splunk, ELK Stack may be installed locally
or as a cloud-based solution.
Third, we have ArcSight.
Now, ArcSight is a SIEM log management
and analytics software that can be used
for compliance reporting for legislation
and regulations like HIPAA, SOX and PCI DSS.
When you look at ArcSight, it looks a lot like any
of the other dashboards I've already shown you,
and again, you can drill down into that information
and display it in lots of different ways too.
Fourth, we have QRadar.
Now, QRadar is another SIEM log management analytics
and compliance reporting platform,
but this one was created by IBM.
Now, QRadar does a lot
of the same stuff we've already talked about,
and again, it comes with a really nice looking dashboard.
As you look at the dashboard, you get different things
that you're going to be looking at, and you can click on those
to dive into them and get more details about your network
and about your events.
Now, in the real world, which of these SIEMs should you use?
Well, that depends which company you're trying
to get a job at or which company do you already work for?
I've worked at a lot of different organizations
over the years, and we've used several
of these different tools, including Splunk, ELK Stack,
and ArcSight at different organizations I've worked with.
So I've had a lot of experience with a lot of these,
and you're probably wondering if one is better
than the other, and honestly,
it really does depend on your use case.
But at the end of the day,
you're probably not going to be the one choosing
which SIEM to use,
and instead, the SIEM you're going to use
is really going to come down to which one your company
is already using
or which one your boss has chosen for your department
to use, especially if you're in the entry
or mid-level portion of your career.
So remember, SIEMs are essential tools
in the cybersecurity landscape
since the SIEM is used to provide real-time analysis
of your security alerts that are being generated
by your applications or network hardware.
Your SIEM can either use agent-based
or agentless approaches,
and there are many examples of SIEMs on the market,
including Splunk, ELK or Elastic Stack, ArcSight and QRadar.