In this lesson,
we're going to cover the different types of data
gained from your security tools.
In cybersecurity,
we use a wide variety of tools
to safeguard our digital assets,
including antivirus software,
data loss prevention systems,
network intrusion detection systems,
network intrusion prevention systems,
firewalls,
vulnerability scanners,
and others to generate a lot of logs,
events, and incident data
for our analysts to be able to look at
as cybersecurity professionals.
Now, this data, when consolidated and analyzed,
can provide invaluable insights
into the security posture of our organizations.
Usually, we're going to rely on a SIEM,
or a security information and event management system,
to serve as that centralized hub for the consolidation
to be able to provide us with a holistic view
of our organization's security landscape.
Let's take a look at the different types of data
that we can receive from our various security tools
inside of our SIEM.
Now, first, we have antivirus software.
Antivirus software is a fundamental security tool
that protects systems against malware,
including viruses, worms, trojans,
ransomware, and spyware.
The data generated by antivirus software
such as malware detection logs,
system scans and updates
can all be sent to a SIEM
for aggregation and correlation
within all of our other systems and device logs.
Now, this data can then be used to provide insights
into potential security threats
and the overall health of all of your systems.
For example,
if a particular system is consistently reporting
that's infected with malware,
this may be a small issue
or an indication of a larger attack
being executed by a given threat actor.
By setting the malware alert data to our SIEM,
our security teams can identify
and address this issue more proactively
by checking the rest of your systems
to determine if the malware infection is spreading
across multiple systems, across your network,
or if it's isolated to this one server
that you're suspecting.
Now, second, we have data loss prevention systems.
Data loss prevention systems, known as DLP systems,
are used to monitor and control data endpoints,
network traffic,
and data stored in the cloud
to prevent potential data breaches from occurring.
These data loss prevention systems
can also generate data about potential data leaks,
policy violations,
and other suspicious user activities.
For example, a DLP system might flag an attempt
to send sensitive company information
like a list of all of your organization's client names,
phone numbers, and emails
by email to somebody outside of your organization.
This data about this potential incident
could also be sent to your SIEM
so that the security team
is alerted to the potential data leak,
and this enables them to perform timely corrective actions
to hopefully prevent this from occurring.
Third, we have network intrusion detection systems
and network intrusion prevention systems.
Now, network intrusion detection systems, known as NIDS,
or network intrusion prevention system, known as NIPS,
are used to monitor network traffic
to detect or prevent malicious activities.
NIDS are used to passively identify any potential threats
and generate alerts when they're being detected.
A NIPS, on the other hand,
is going to be used to proactively block
or prevent these potential threats
from accessing your network in the first place.
Now, data from both our NIDS and NIPS,
including detected threats,
block traffic and network anomalies,
can also be sent to your organization SIEM
for correlation and aggregation.
This type of data can help to identify
patterns of malicious activity,
potential security vulnerabilities,
and the effectiveness
of your organization's intrusion prevention measures.
Fourth, we have firewalls.
Now, firewalls serve as a barrier
between a trusted internal network
and an untrusted external network.
Firewalls are going to be used to filter
incoming and outgoing network traffic
based upon predetermined sets of security rules,
which we call access control lists or ACLs.
Firewalls can generate logs that contain data
about allowed and blocked traffic,
rule changes, and any detected potential threats.
By sending our firewall data to our SIEM,
our organization can monitor its network perimeter security
and identify any potential intrusion attempts
because we can use this
as part of our overall security posture.
Now, for example, let's say
that you see somebody who's pinging your web server
by checking if any ports are open
between port 0 and port 1023.
Now, this would show up as a port scan
that's being conducted against our server,
and this could be an indication
that a threat actor is performing
some kind of reconnaissance
against your organizational systems,
and you would see that by checking these firewall logs
inside of your SIEM.
Fifth and finally,
we have vulnerability scanners.
Now, vulnerability scanners are tools that are used
to identify security weaknesses in a system,
including missing security patches,
incorrect configurations,
and other types of known vulnerabilities.
A vulnerability scanner can generate data
about identified vulnerabilities,
their severity,
and recommended remediation steps.
By integrating all this data into your SIEM,
your organization can prioritize
your vulnerability remediation efforts
based on the severity and potential impact
of that given vulnerability.
Additionally, we can also use this kind of data
to track our organization's remediation progress
and verify the effectiveness
of the remediation steps that we are performing.
So remember, by consolidating data
from these diverse security tools
into a centralized SIEM,
our organizations can get a comprehensive view
of our security posture.
Data can be gathered from our antivirus software,
data loss prevention systems,
network intrusion detection systems,
network intrusion prevention systems,
firewalls,
vulnerability scanners,
and many others to generate a lot of logs,
events, and incident data
that we can then analyze as cybersecurity professionals.
This helps us proactively identify
and address any potential security threats
and ensure our organization remains well-protected.