SIEM Introduction Seminar - Iman Mansoori

Security Information and Event Management(SIEM)
Iman Mansouri –Sr. Security Solutions Consultant

CCIE,CEH,CHFI,ECSA,NSE4,JNCIP,ArcSight ATP, Splunk Architect
@Cisco_in_persian_channel Telegram.me/SOC24x7
Agenda
Agenda
• Instructor Introduction
• Information Security Risk
• Why we need SIEM
• SIEM Components
• Demo - Splunk
@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Telegram.me/SOC24x7 MANAGEMENT(SIEM)
Good Facts
Cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Information Security Risk

CIA Triad

Asset Value

Risk Definition
From the IT security perspective, risk management is the process of

understanding and responding to factors that may lead to a failure in the
confidentiality, integrity or availability of an information system

Risk Definition
Process Malware AV
Systems Exploit Kits Firewall
Network Bots IPS
Application APT Sandbox
Etc. Etc. Etc.

Risk Definition
Confidentiality Integrity Availability
• Password • Watering the • Resource

Compromise hole Exhaustion
• Data Leakage • Backdoor • Ransomware
• Data Exposure • Data
Injection

Risk Identification

Risk Prioritization

Wrap Up

Why?
Why We need SIEM?

The Answer
SIEM, is an evolved concept
• SIEM is a concept evolved within last few years
• We started we simple data collection and are now facing advanced capabilities
• SIEM concept main job is turn our data into knowledge and from knowledge to
wisdom
• Basically SIEM job is to provide situational awareness and priority based incident
detection and alerting
• To perform this, SIEM handles both mentioned functions
– Data Collection
– Data Processing, analyzing and making decision
• SIEM is not and smart entity and can only analyze and make decision based on what
is told
• Perfect feeding, tuning and optimization of SIEM is the key factor into SIEM
successful optimization
• WE DON’T SOC TO RUN SIEM

SIEM Vendors
• We have number of domestic and international role players in SIEM
• Vendors:
– Ravin, Correlog, Parham, Mavara and etc.
– HP ArcSight, Splunk, Log Point, Qradar and etc.
• Capabilities and features provided differentiates between these products

• Gartner and forester are great references to study pros and cons of each products

HOW
SIEM Components

SIEM Main components
• Every SIEM should include number of component and modules

• These modules can be categorized into 6 groups:
– Data Collection
– Parser and Normalizer and sometimes enrichment
– Analyzer
– Visualization and dashboard
– Reporting
– Storage
• Each component will be explained separately in following slides

Collect My Data !
• Data Collection module is made of two elements

– Sensors sending data
– Collector daemons collecting the received data
• Data collection can be done in two way:

– Pull-Based ( Data based queries, Remote Windows Log Collection or Etc.)
– Pushed-Based ( Agents, Syslog and Etc.)
• The more collection method we support the better SIEM we have

• Example agents include :
– SmartConnector from ArcSight
– Forwarding Agent of Splunk
– Wincollect from Qradar

Parse and Normalize !
• First step to process and make data meaning is data parsing and normalization
• Here we extract data from our data (logs) and map into what we can understand
• Mostly, Regex is used for parsing
• Mapping our extracted to a field is called normalization
• Here is the example:
Sep 29 23:49:20 SRX-1 RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.0.0.1/54924-

>192.168.1.1/53 junos-dns-udp 17(0) default-deny(global) trust trust UNKNOWN UNKNOWN N/A(N/A) ge-
0/0/0.0 UNKNOWN policy deny
regexp="(?P<date>\w{3}\s+\d{1,2}\s\d{2}\:\d{2}\:\d{2})\s+(?P<device>\S+)\s+\S+\s+\S+\s+RT_FLOW\s+-
\s+(?P<module>\S+).*source-address=\"(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\"\s+source-
port=\"(?P<src_port>\d+)\"\s+destination-address=\"(?P<dst_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\"\s+destination-
port=\"(?P<dst_port>\d+)\"\s+service-name=\"(?P<service>\S+)\"\s+protocol-id=\"(?P<protocol>\S+)\"\s+icmp-
type=\"(?P<icmp>\S+)\"\s+policy-name=\"(?P<policy>\S+)\"\s+source-zone-
name=\"(?P<src_zone>\S+)\"\s+destination-zone-name=\"(?P<dst_zone>\S+)\".*"

Analyze and Decide !
• In Analyzer module we used different technique to detect cyber attacks, footprint of

attacks, breaches and anomalies from the logs
• We have events rules, statistical calculation , pattern discovery and AI to help us find
these data
• Here we decide to alert, report or event generate more events
• In rules, we used conditions to identify indictors in our logs
• We have simple conditioning , Correlation and Complex Event Processing (CEP)
– Destination IP address equals xxx (C&C detection)
– Port equals 3389 and connection from non-admin zones (Unauthorized Access/Malware/Breach)
– Antivirus detects a virus and then high amount of traffic from that machine
• We have statistical calculations
– Moving average of firewall changes +50 percent (Traffic spikes)
– High number of login failures from same machine (Account harvesting, Bruteforce authentication)



Visualization and Dashboarding
• Here I visualize both my raw data and processed data

• Here I can used tables, graphs, trends, charts and maps help me:
– View my data
– Find anomalies
– situational awareness

Alerting and Reporting
• In the final step, SIEM will alert regarding the detected or suspicious incident
• Alerts can be sent via Email, syslog message or an Event
• Event generation helps SIEM to perform multiple event chaining
• Here our alerts our prioritized and evaluated based on :
– Attack severity
– Asset Value
– Relevance
– Risk rating

Iman Mansouri –Sr. Security Solutions Consultant
[email protected]
Tel: +98 9126139728
Telegram.me/SOC24x7
@cisco_in_persian_channel


SIEM Introduction Seminar - Iman Mansoori

Uploaded by

Copyright:

Available Formats

SIEM Introduction Seminar - Iman Mansoori

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SIEM Introduction Seminar - Iman Mansoori

Uploaded by

Copyright:

Available Formats

Security Information and Event Management(SIEM)

Iman Mansouri –Sr. Security Solutions Consultant

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

From the IT security perspective, risk management is the process of

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Confidentiality Integrity Availability

• Password • Watering the • Resource

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Why We need SIEM?

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

• Capabilities and features provided differentiates between these products

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

• Every SIEM should include number of component and modules

• Each component will be explained separately in following slides

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

• Data Collection module is made of two elements

• Data collection can be done in two way:

• The more collection method we support the better SIEM we have

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

Sep 29 23:49:20 SRX-1 RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.0.0.1/54924-

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

• In Analyzer module we used different technique to detect cyber attacks, footprint of

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

• Here I visualize both my raw data and processed data

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

@cisco_in_persian_channel SECURITY INFORMATION AND EVENT

You might also like