Improve Threat Detection with OSSEC and AlienVault USM
Download as PPTX, PDF3 likes3,425 views
Host-based IDS systems, or HIDS, work by monitoring activity that is occurring internally on a host. HIDS look for unusual or nefarious activity by examining logs created by the operating system, looking for changes made to key system files, tracking installed software, and sometimes examining the network connections a host makes. AlienVault USM features a complete integration of OSSEC, one of the most popular and effective open source HIDS tools. In this live demo, we'll show you how USM helps you get more out of OSSEC with: Remote agent deployment, configuration and management Behavioral monitoring of OSSEC clients Logging and reporting for PCI compliance Data correlation with IP reputation data, vulnerability scans and more We'll finish up by showing a demo of how OSSEC alert correlation can be used to detect brute force attacks with USM
1 of 12
Downloaded 113 times
Ad
Recommended
Denys Serhiienko "ASGI in depth"
Denys Serhiienko "ASGI in depth"Fwdays With the advent of asyncio, the python community started to build new performant web frameworks and servers for asynchronous backends. In this way, ASGI specification appeared as a successor to WSGI.
In this talk, we will take a closer look into the details of this new specification and consider its implementation in the uvicorn server and Starlette framework.
OSSIM Overview
OSSIM Overviewn|u - The Open Security Community This document provides an overview of deploying and configuring the open source security information and event management (SIEM) solution OSSIM. It discusses setting up OSSEC host-based intrusion detection system agents, configuring syslog forwarding and enabling plugins, performing vulnerability scans of network assets, and demonstrates OSSIM's integrated capabilities. The document emphasizes that prevention alone is not sufficient and that detective controls are also needed to effectively detect and respond to security incidents across the network.
Revenue Reconciliation System
Revenue Reconciliation SystemMahesh Patwardhan A Revenue Reconciliation and Settlement System that was built to provide an automated and systemic approach to recognizing revenues across the various revenue streams of the organization.
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...
I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Di...DirkjanMollema
Azure AD is everything but a domain controller in the cloud. This talk will cover what Azure AD is, how it is commonly integrated with Active Directory and how security boundaries extend into the cloud, covering sync account password recovery, privilege escalations in Azure AD and full admin account takeovers using limited on-premise privileges.
While Active Directory has been researched for years and the security boundaries and risks are generally well documented, more and more organizations are extending their network into the cloud. A prime example of this is Office 365, which Microsoft offers through their Azure cloud. Connecting the on-premise Active Directory with the cloud introduces new attack surface both for the cloud and the on-premise directory.
This talk looks at the way the trust between Active Directory and Azure is set up and can be abused through the Azure AD Connect tool. We will take a dive into how the synchronization is set up, how the high-privilege credentials for both the cloud and Active Directory are protected (and can be obtained) and what permissions are associated with these accounts.
The talk will outline how a zero day in common setups was discovered through which on-premise users with limited privileges could take over the highest administration account in Azure and potentially compromise all cloud assets.
We will also take a look at the Azure AD architecture and common roles, and how attackers could backdoor or escalate privileges in cloud setups.
Lastly we will look at how to prevent against these kind of attacks and why your AD Connect server is perhaps one of the most critical assets in the on-premise infrastructure.
Cloud penetration testing
Cloud penetration testingvericlouds11 Penetration testing is set of system through which security system is checked to find out how it works during the time of threats. By this all the lope holes are taken out and are sorted out for better performance of the system in preventing hacking.
Beyond REST and RPC: Asynchronous Eventing and Messaging Patterns
Beyond REST and RPC: Asynchronous Eventing and Messaging PatternsClemens Vasters In this session you will learn about when and why to use asynchronous communication with and between services, what kind of eventing/messaging infrastructure you can use in the cloud and on the edge, and how to make it all work together.
Backdoor
Backdoorphanleson The document discusses Trojans and backdoors. It defines a Trojan as a hidden program that runs on an infected computer and a backdoor as a program that allows hackers to connect without normal authentication. It describes how they are used to gain remote access or disable protections. The document outlines Trojan types and infection mechanisms like wrapper programs and autorun files. It provides examples of hacking tools and recommendations for detection and prevention like using antivirus software and educating users.
Bypass_AV-EDR.pdf
Bypass_AV-EDR.pdfFarouk2nd Comment contourner les mécanismes de sécurité type antivirus et EDR pour exécuter du code ou exfiltrer de la data
Apache Knox Gateway "Single Sign On" expands the reach of the Enterprise Users
Apache Knox Gateway "Single Sign On" expands the reach of the Enterprise UsersDataWorks Summit Apache Knox Gateway is a proxy for interacting with Apache Hadoop clusters in a secure way providing authentication, service level authorization, and many other extensions to secure any HTTP interactions in your cluster. One main feature of Apache Knox Gateway is the ability to extend the reach of your REST APIs to the internet while still securing your cluster and working with Kerberos. Recent contributions to the Apache Knox community have added support for Single Sign On (SSO) based on Pac4j 1.8.9 which is a very powerful security engine which provides SSO support through SAML2, OAuth, OpenID, and CAS. In addition, through recent community contributions Apache Ambari, and Apache Ranger can now also provide SSO authentication through Knox. This paper will discuss the architecture of Knox SSO, it will explain how enterprise user could benefit by this feature and will present enterprise use cases for Knox SSO, and integration with open source Shibboleth, ADFS Windows server Idp support, and Okta cloud Idp.
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Ajin Abraham Mobile Security Framework (MobSF) is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static and dynamic analysis. It can be used for effective and fast security analysis of Android and iOS Applications and supports both binaries (APK & IPA) and zipped source code. MobSF can also perform Web API Security testing with it's API Fuzzer that can do Information Gathering, analyze Security Headers, identify Mobile API specific vulnerabilities like XXE, SSRF, Path Traversal, IDOR, and other logical issues related to Session and API Rate Limiting.
Building an IP Reputation Engine: Tracking the Miscreants
Building an IP Reputation Engine: Tracking the MiscreantsAlienVault The AlienVault Open Threat Exchange™ (AV-OTX™) is a system for sharing threat intelligence among OSSIM users and AlienVault customers. Go behind the scenes and find out how it works!
A Threat Hunter Himself
A Threat Hunter HimselfSergey Soldatov The document provides biographies and background information on two cyber threat hunters, Teymur Kheirkhabarov and Sergey Soldatov. It then discusses the process of cyber threat hunting, including collecting log and system event data from endpoints, analyzing that data using tools like Yara and Cuckoo Sandbox, and manually investigating anomalies through iterative hypothesis testing to detect advanced threats. Examples are given of how threat hunters traced back the steps of an attacker who compromised a system by injecting code into the LSASS process and establishing persistence via a scheduled task. The document emphasizes that threat hunting requires both machine analysis of large datasets as well as human reasoning to uncover sophisticated threats that evade other security solutions.
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2Scott Sutherland This presentation will provide an overview of what a penetration test is, why companies pay for them, and what role they play in most IT security programs. It will also include a brief overview of the common skill sets and tools used by today’s security professionals. Finally, it will offer some basic advice for getting started in penetration testing. This should be interesting to aspiring pentesters trying to gain a better understanding of how penetration testing fits into the larger IT security world.
Additional resources can be found in the blog below:
https://www.netspi.com/blog/entryid/140/resources-for-aspiring-penetration-testers
More security blogs by the authors can be found @
https://www.netspi.com/blog/
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov Slides from my talk at the OFFZONE 2018 conference (https://www.offzone.moscow/report/hunting-for-privilege-escalation-in-windows-environment/)
Intro to Pentesting Jenkins
Intro to Pentesting JenkinsBrian Hysell Conduct a few internal pen tests and you’re bound to come across Jenkins, the world’s most popular build automation server. When you encounter it, what do you do? Go beyond a 5-minute Google search and checking for open script consoles. This talk dives into various ways to exploit Jenkins and how to move laterally into sensitive systems.
(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory PwnagePetros Koutroumpis Identifying privilege escalation paths within an Active Directory environment is crucial for a successful red team. Over the last few years, BloodHound has made it easier for red teamers to perform reconnaissance activities and identify these attacks paths. When evaluating BloodHound data, it is common to find ourselves having sufficient rights to modify a Group Policy Object (GPO). This level of access allows us to perform a number of attacks, targeting any computer or user object controlled by the vulnerable GPO.
In this talk we will present previous research related to GPO abuses and share a number of misconfigurations we have found in the wild. We will also present a tool that allows red teamers to target users and computers controlled by a vulnerable GPO in order to escalate privileges and move laterally within the environment.
Json Web Token - JWT
Json Web Token - JWTPrashant Walke In this PPT, the fundamentals of what JSON Web Token (JWT), and why they are used in REST API will be explained.
Continuous monitoring with OSSIM
Continuous monitoring with OSSIMEguardian Global Services This document provides an overview of setting up practical monitoring with the open source security information management (SIM) tool OSSIM. It discusses identifying assets and data sources, the OSSIM platform capabilities, architecture, requirements, and basic configuration steps. It also covers adding assets, configuring vulnerability assessment, setting up host and network intrusion detection systems, enabling plugins for integrating devices like CheckPoint firewalls, and configuring availability monitoring. The document provides details on key concepts like regular expressions, correlation rules, and using the OSSIM dashboard.
Pushed Authorization Requests
Pushed Authorization RequestsTorsten Lodderstedt Pushed authorization requests allow clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request and provides them with a request URI that is used as reference to the data in a subsequent authorization request.
Time based CAPTCHA protected SQL injection through SOAP-webservice
Time based CAPTCHA protected SQL injection through SOAP-webserviceFrans Rosén Frans Rosén of detectify discusses SQL injection techniques through a SOAP webservice. He provides steps to create a proof of concept attack with as few requests as possible to find vulnerable storefronts. Examples are given of time-based SQL injection payloads using substring, ascii, and sleep functions to retrieve the username and potentially other information about the target host. A link is also provided to a paper on SQL injection optimization and obfuscation techniques.
OpenID Connect 4 SSI
OpenID Connect 4 SSITorsten Lodderstedt OpenID Connect 4 SSI is an initiative conducted at OpenID Foundation in liaison with the Decentralized Identity Foundation. It aims at specifying a set of protocols based on OpenID Connect to enable SSI applications.
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim HegazyHackIT Ukraine During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Traversal, DOS, Cross Site Scripting and else of web application vulnerabilities with demo codes. Also, we will see things from both Developers and Attackers side. What are the protections done by Developers to mitigate file upload issues by validating File Name, File Content-Type, actual File Content and how to bypass it All using 15 Technique!
Module 4 Enumeration
Module 4 Enumerationleminhvuong The document discusses techniques for enumerating information from systems during the hacking process. It describes establishing null sessions to extract user names, shares, and other details without authentication. Tools like DumpSec, Netview, Nbtstat, GetAcct, and PS Tools are also covered as ways to enumerate users, groups, shares, permissions, and more from Windows and UNIX systems. The document also provides countermeasures like restricting null sessions and the anonymous user to protect against enumeration attacks.
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov The document discusses various techniques attackers can use to launch executables remotely on Windows systems by leveraging compromised credentials and built-in OS functionality. It describes how to detect remotely launched executables using Windows Event and Sysmon logs. Specific techniques covered include remote file copy over SMB, remote execution via WMI, WinRM, Powershell Remoting, scheduled tasks, services, the registry, and WMI subscriptions. The document provides the event sequences and most interesting events to look for when hunting for evidence of each technique.
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS FilterMasato Kinugawa 2015/12: I removed some slides because some vectors are not fixed yet.
2016/12: Disclosed full verson
Bug Bounty Hunter Methodology - Nullcon 2016
Bug Bounty Hunter Methodology - Nullcon 2016bugcrowd This is a bug bounty hunter presentation given at Nullcon 2016 by Bugcrowd's Faraz Khan.
Learn more about Bugcrowd here: https://bugcrowd.com/join-the-crowd
Understanding JWT Exploitation
Understanding JWT ExploitationAkshaeyBhosale JSON Web Tokens (JWTs) are compact, self-contained tokens used to securely transmit information between parties as JSON objects. JWTs contain a header, payload, and signature. The header typically specifies the token type and signing algorithm being used. The payload contains claims about the user such as username, ID, and expiration time. The signature ensures the token integrity. JWTs are signed using a secret or public/private key pair to authenticate and securely exchange information.
Improve threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmAlienVault Host-based intrusion dection systems (HIDS) work by monitoring activity that is occurring internally on a host. HIDS look for unusual or nefarious activity by examining logs created by the operating system, looking for changes made to key system files, tracking installed software, and sometimes examining the network connections a host makes. AlienVault USM integrates HIDS with other key security controls to help you get the most out of HIDS, including:
Analyzing system behavior and configuration status to track user access and activity
Detecting system compromise, modification of critical configuration files (e.g. registry settings, /etc/passwd), common rootkits, and rogue processes
Correlating HIDS data with known IP reputation, vulnerability scans and more
Logging and reporting for PCI compliance
How to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVaultAlienVault Watch this on-demand webast to learn how to acheive security compliance with AlienVault Unified Security Management (USM): https://www.alienvault.com/resource-center/webcasts/how-to-solve-your-top-it-security-reporting-challenges-with-alienvault?utm_medium=Social&utm_source=SlideShare&utm_campaign=solve-it-compliance-usm-webinar
Learn how you can take your on-premises and cloud security to the next level with a free online demo at: https://www.alienvault.com/products/usm-anywhere/demo?utm_medium=Social&utm_source=SlideShare&utm_campaign=solve-it-compliance-usm-webinar
Ad
More Related Content
What's hot (20)
Apache Knox Gateway "Single Sign On" expands the reach of the Enterprise Users
Apache Knox Gateway "Single Sign On" expands the reach of the Enterprise UsersDataWorks Summit Apache Knox Gateway is a proxy for interacting with Apache Hadoop clusters in a secure way providing authentication, service level authorization, and many other extensions to secure any HTTP interactions in your cluster. One main feature of Apache Knox Gateway is the ability to extend the reach of your REST APIs to the internet while still securing your cluster and working with Kerberos. Recent contributions to the Apache Knox community have added support for Single Sign On (SSO) based on Pac4j 1.8.9 which is a very powerful security engine which provides SSO support through SAML2, OAuth, OpenID, and CAS. In addition, through recent community contributions Apache Ambari, and Apache Ranger can now also provide SSO authentication through Knox. This paper will discuss the architecture of Knox SSO, it will explain how enterprise user could benefit by this feature and will present enterprise use cases for Knox SSO, and integration with open source Shibboleth, ADFS Windows server Idp support, and Okta cloud Idp.
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Ajin Abraham Mobile Security Framework (MobSF) is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static and dynamic analysis. It can be used for effective and fast security analysis of Android and iOS Applications and supports both binaries (APK & IPA) and zipped source code. MobSF can also perform Web API Security testing with it's API Fuzzer that can do Information Gathering, analyze Security Headers, identify Mobile API specific vulnerabilities like XXE, SSRF, Path Traversal, IDOR, and other logical issues related to Session and API Rate Limiting.
Building an IP Reputation Engine: Tracking the Miscreants
Building an IP Reputation Engine: Tracking the MiscreantsAlienVault The AlienVault Open Threat Exchange™ (AV-OTX™) is a system for sharing threat intelligence among OSSIM users and AlienVault customers. Go behind the scenes and find out how it works!
A Threat Hunter Himself
A Threat Hunter HimselfSergey Soldatov The document provides biographies and background information on two cyber threat hunters, Teymur Kheirkhabarov and Sergey Soldatov. It then discusses the process of cyber threat hunting, including collecting log and system event data from endpoints, analyzing that data using tools like Yara and Cuckoo Sandbox, and manually investigating anomalies through iterative hypothesis testing to detect advanced threats. Examples are given of how threat hunters traced back the steps of an attacker who compromised a system by injecting code into the LSASS process and establishing persistence via a scheduled task. The document emphasizes that threat hunting requires both machine analysis of large datasets as well as human reasoning to uncover sophisticated threats that evade other security solutions.
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2Scott Sutherland This presentation will provide an overview of what a penetration test is, why companies pay for them, and what role they play in most IT security programs. It will also include a brief overview of the common skill sets and tools used by today’s security professionals. Finally, it will offer some basic advice for getting started in penetration testing. This should be interesting to aspiring pentesters trying to gain a better understanding of how penetration testing fits into the larger IT security world.
Additional resources can be found in the blog below:
https://www.netspi.com/blog/entryid/140/resources-for-aspiring-penetration-testers
More security blogs by the authors can be found @
https://www.netspi.com/blog/
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov Slides from my talk at the OFFZONE 2018 conference (https://www.offzone.moscow/report/hunting-for-privilege-escalation-in-windows-environment/)
Intro to Pentesting Jenkins
Intro to Pentesting JenkinsBrian Hysell Conduct a few internal pen tests and you’re bound to come across Jenkins, the world’s most popular build automation server. When you encounter it, what do you do? Go beyond a 5-minute Google search and checking for open script consoles. This talk dives into various ways to exploit Jenkins and how to move laterally into sensitive systems.
(Ab)Using GPOs for Active Directory Pwnage
(Ab)Using GPOs for Active Directory PwnagePetros Koutroumpis Identifying privilege escalation paths within an Active Directory environment is crucial for a successful red team. Over the last few years, BloodHound has made it easier for red teamers to perform reconnaissance activities and identify these attacks paths. When evaluating BloodHound data, it is common to find ourselves having sufficient rights to modify a Group Policy Object (GPO). This level of access allows us to perform a number of attacks, targeting any computer or user object controlled by the vulnerable GPO.
In this talk we will present previous research related to GPO abuses and share a number of misconfigurations we have found in the wild. We will also present a tool that allows red teamers to target users and computers controlled by a vulnerable GPO in order to escalate privileges and move laterally within the environment.
Json Web Token - JWT
Json Web Token - JWTPrashant Walke In this PPT, the fundamentals of what JSON Web Token (JWT), and why they are used in REST API will be explained.
Continuous monitoring with OSSIM
Continuous monitoring with OSSIMEguardian Global Services This document provides an overview of setting up practical monitoring with the open source security information management (SIM) tool OSSIM. It discusses identifying assets and data sources, the OSSIM platform capabilities, architecture, requirements, and basic configuration steps. It also covers adding assets, configuring vulnerability assessment, setting up host and network intrusion detection systems, enabling plugins for integrating devices like CheckPoint firewalls, and configuring availability monitoring. The document provides details on key concepts like regular expressions, correlation rules, and using the OSSIM dashboard.
Pushed Authorization Requests
Pushed Authorization RequestsTorsten Lodderstedt Pushed authorization requests allow clients to push the payload of an OAuth 2.0 authorization request to the authorization server via a direct request and provides them with a request URI that is used as reference to the data in a subsequent authorization request.
Time based CAPTCHA protected SQL injection through SOAP-webservice
Time based CAPTCHA protected SQL injection through SOAP-webserviceFrans Rosén Frans Rosén of detectify discusses SQL injection techniques through a SOAP webservice. He provides steps to create a proof of concept attack with as few requests as possible to find vulnerable storefronts. Examples are given of time-based SQL injection payloads using substring, ascii, and sleep functions to retrieve the username and potentially other information about the target host. A link is also provided to a paper on SQL injection optimization and obfuscation techniques.
OpenID Connect 4 SSI
OpenID Connect 4 SSITorsten Lodderstedt OpenID Connect 4 SSI is an initiative conducted at OpenID Foundation in liaison with the Decentralized Identity Foundation. It aims at specifying a set of protocols based on OpenID Connect to enable SSI applications.
"15 Technique to Exploit File Upload Pages", Ebrahim Hegazy
"15 Technique to Exploit File Upload Pages", Ebrahim HegazyHackIT Ukraine During the session we will go through different methods of exploiting file upload pages in order to trigger Remote Code Execution, SQL Injection, Directory Traversal, DOS, Cross Site Scripting and else of web application vulnerabilities with demo codes. Also, we will see things from both Developers and Attackers side. What are the protections done by Developers to mitigate file upload issues by validating File Name, File Content-Type, actual File Content and how to bypass it All using 15 Technique!
Module 4 Enumeration
Module 4 Enumerationleminhvuong The document discusses techniques for enumerating information from systems during the hacking process. It describes establishing null sessions to extract user names, shares, and other details without authentication. Tools like DumpSec, Netview, Nbtstat, GetAcct, and PS Tools are also covered as ways to enumerate users, groups, shares, permissions, and more from Windows and UNIX systems. The document also provides countermeasures like restricting null sessions and the anonymous user to protect against enumeration attacks.
Hunting Lateral Movement in Windows Infrastructure
Hunting Lateral Movement in Windows InfrastructureSergey Soldatov The document discusses various techniques attackers can use to launch executables remotely on Windows systems by leveraging compromised credentials and built-in OS functionality. It describes how to detect remotely launched executables using Windows Event and Sysmon logs. Specific techniques covered include remote file copy over SMB, remote execution via WMI, WinRM, Powershell Remoting, scheduled tasks, services, the registry, and WMI subscriptions. The document provides the event sequences and most interesting events to look for when hunting for evidence of each technique.
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS Filter
X-XSS-Nightmare: 1; mode=attack XSS Attacks Exploiting XSS FilterMasato Kinugawa 2015/12: I removed some slides because some vectors are not fixed yet.
2016/12: Disclosed full verson
Bug Bounty Hunter Methodology - Nullcon 2016
Bug Bounty Hunter Methodology - Nullcon 2016bugcrowd This is a bug bounty hunter presentation given at Nullcon 2016 by Bugcrowd's Faraz Khan.
Learn more about Bugcrowd here: https://bugcrowd.com/join-the-crowd
Understanding JWT Exploitation
Understanding JWT ExploitationAkshaeyBhosale JSON Web Tokens (JWTs) are compact, self-contained tokens used to securely transmit information between parties as JSON objects. JWTs contain a header, payload, and signature. The header typically specifies the token type and signing algorithm being used. The payload contains claims about the user such as username, ID, and expiration time. The signature ensures the token integrity. JWTs are signed using a secret or public/private key pair to authenticate and securely exchange information.
Similar to Improve Threat Detection with OSSEC and AlienVault USM (20)
Improve threat detection with hids and alien vault usm
Improve threat detection with hids and alien vault usmAlienVault Host-based intrusion dection systems (HIDS) work by monitoring activity that is occurring internally on a host. HIDS look for unusual or nefarious activity by examining logs created by the operating system, looking for changes made to key system files, tracking installed software, and sometimes examining the network connections a host makes. AlienVault USM integrates HIDS with other key security controls to help you get the most out of HIDS, including:
Analyzing system behavior and configuration status to track user access and activity
Detecting system compromise, modification of critical configuration files (e.g. registry settings, /etc/passwd), common rootkits, and rogue processes
Correlating HIDS data with known IP reputation, vulnerability scans and more
Logging and reporting for PCI compliance
How to Solve Your Top IT Security Reporting Challenges with AlienVault
How to Solve Your Top IT Security Reporting Challenges with AlienVaultAlienVault Watch this on-demand webast to learn how to acheive security compliance with AlienVault Unified Security Management (USM): https://www.alienvault.com/resource-center/webcasts/how-to-solve-your-top-it-security-reporting-challenges-with-alienvault?utm_medium=Social&utm_source=SlideShare&utm_campaign=solve-it-compliance-usm-webinar
Learn how you can take your on-premises and cloud security to the next level with a free online demo at: https://www.alienvault.com/products/usm-anywhere/demo?utm_medium=Social&utm_source=SlideShare&utm_campaign=solve-it-compliance-usm-webinar
Advanced OSSEC Training: Integration Strategies for Open Source Security
Advanced OSSEC Training: Integration Strategies for Open Source SecurityAlienVault This document summarizes an advanced training on integrating OSSEC and AlienVault for open source security. The presentation covers the capabilities and architecture of OSSEC and AlienVault, how they integrate, and a demo of deploying OSSEC agents, managing alerts, and correlating events across sources. OSSEC provides log analysis, file integrity checking, and signature-based malware detection while AlienVault adds threat detection capabilities, centralized management, risk assessment, and cross-source event correlation to strengthen security monitoring.
PCI DSS Reporting Requirements for People Who Hate PCI DSS Reporting
PCI DSS Reporting Requirements for People Who Hate PCI DSS ReportingAlienVault This document summarizes a presentation about using AlienVault's Unified Security Management (USM) platform to generate PCI DSS compliance reports. The presentation discusses key logging and reporting requirements of the PCI standard, and how USM can collect log data from systems using its sensors and correlate events to detect threats and anomalies. It demonstrates how pre-configured reports in USM map directly to each PCI requirement and can be automated and scheduled to produce evidence for auditors, showing compliance on an ongoing basis in just minutes.
Security Operation Center : Le Centre des Opérations de Sécurité est une div...
Security Operation Center : Le Centre des Opérations de Sécurité est une div...Khaledboufnina Le Centre des Opérations de Sécurité est une division, dans une entreprise, qui assure la sécurité de l'organisation et surtout le volet sécurité de l'information.
Technology
• For SOC Team members, technology is their weapon, they use it to collect
different type of logs (login events, activities etc).
• Team comprises of people uses least amount of resources to get good visibility into active and emerging
threats.
• Continuous consolidation of technologies and effectively organizing team is required
Host based Defence
• Host includes physical / virtual OS that are allocated to the employee of organization
• Enterprise majorly have the following OS’s:
• Windows
• Linux
• Mac
• Tools like OSQuery (cross-platform), Sysmon (Windows) etc can be used to collect
and transmit logs for analysing performance of hosts devices
Host Firewall - Windows
• Defender host firewall present in Win Vista, 7, 8, 10, 11 & server edition.
• It helps secure the devices by in-bound & out-bound rules.
• The rules states which network traffic can go in and out from the device
• Inbound Rules : Network traffic coming from the external device. Ex : Someone tries to
connect to FTP Server on host machine.
• Outbound rules : Network traffic originating from the host device. Ex : Host machine tries to
connect to a web server.
• Connection Rules : Used to filter the network traffic going in and out the host device
•Host Firewall – iptables
• Firewall utility that comes in-built in most Linux operating systems.
• It is a command line utility, that filters network traffic going-in or going-out of
the system.
• Iptables has 3 different chains, namely:
• Input : Controls incoming connections. Ex : SSH into host machine with iptables enabled
• Output : Controls outgoing connections. Ex : Sending ICMP packets to a destination
• Forward : Helpful during routing scenarios, utilizes traffic forwarding utilities to sent data
to destined address
• Connection Specific Responses
• ACCEPT : Allow the connection
• DROP : Drop the connection without sending any errors
• REJECT : Drop the connection but send back an error response
• Block connection from a range of IP address
Anti-Virus
• In General Terms, it is a computer program used to prevent, detect and remove malicious s/w.
• They continuously scan incoming files (coming to system from everywhere) and if any anomaly is
detected, it is quarantined / removed.
• The Landscape of security has moved a lot from focusing only a single device to end-point devices
like Cell-phone, Enterprise laptop, Tablet, Servers, Computers etc.
• End Point Security protects network, using a combination of FireWall, AntiVirus, Anti-Malware etc.
• They are explicitly designed for enterprise clients to protect all their endpoints devices like servers,
computers, mobile etc
• Understanding Naming Context, it is clear that EDR is a solution that
continuously monitors, stores endpoint-devices behaviour to detect and
block suspicious / malicious act
Detection and Analysis of 0-Day Threats
Detection and Analysis of 0-Day ThreatsInvincea, Inc. As threats are increasingly more sophisticated and targeted, traditional anti-virus detection is struggling to keep up. The traditional approach focuses on using fingerprint signatures of known malware to identify malware in the enterprise. This method of fingerprinting for detection is not only easily evaded, but it provides limited value to detecting targeted attacks against companies and emerging threats.
To combat this problem, Invincea developed a novel method for detecting and analyzing previously unknown malware and 0-day exploits. The advanced detection approach runs in conjunction with Invincea’s secure virtual container, which is used to isolate the operating system and user data from exploits against vulnerable applications. By running high-risk apps like web browsers in a secure container, no prior knowledge, including signatures and IOCs of threats is required in order to prevent their damage to the system and loss of data.
Infosec cert service
Infosec cert serviceMinh Le SK Infosec is a South Korean security services provider with over 860 employees. It offers security consulting, system integration, monitoring and management services. In recent years, its annual revenue and growth have increased substantially, with total revenue reaching nearly $101 million in 2012 and growth of 14.7% that year. SK Infosec provides a full range of managed security services including prevention, management, monitoring and incident handling for its customers in Korea.
ISACA -Threat Hunting using Native Windows tools .pdf
ISACA -Threat Hunting using Native Windows tools .pdfGurvinder Singh, CISSP, CISA, ITIL v3 Threat Hunting with Windows Event Forwarding & MITRE ATT&CK Framework
In this talk, you will gain an overview of using Windows Event Forwarding (WEF) for incident detection, with configuration and management workflows guidance. The talk will also provide an introduction to the MITRE ATT&CK Framework.
Azure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and complianceAsaf Nakash Today’s IT Security and Operations teams are tasked with managing highly complex, hybrid-cloud, cross-platform systems which are increasingly vulnerable to a growing number of sophisticated cyber-attacks. With this, IT Operations teams have a requirement to identify any threats to their environment as soon as possible to mitigate damages, as well as continue to cost-effectively meet SLAs.
OSSEC Holidaycon 2020.pdf
OSSEC Holidaycon 2020.pdfMohamed Taoufik TEKAYA This document provides an agenda and information about the OSSEC Holiday Con 2021 conference. The 4-day conference includes presentations on days 1 and 2, and optional training sessions on days 3 and 4. Attendees can still sign up for the conference until the end of day 2. Leadership of the OSSEC project and foundation are introduced. An overview of OSSEC is provided, including its history and capabilities in log analysis, file integrity monitoring, compliance, and malware detection. Upcoming changes, the roadmap, and questions are discussed at a high level.
Managed security services
Managed security servicesmanoharparakh The document discusses managed security services offered by ESDS including security operations centers (SOC) that provide monitoring, analytics, and incident response. It describes three SOC solutions - Eagle Eye for monitoring, Security Insight for assessments, and Total Secure for integrated services. The document also overview eNlight web application firewall and web VPN solutions, highlighting their features such as protecting against OWASP threats and providing granular access control. It argues that managed security services can enhance organizations' security posture through monitoring, alerting and rapid deployment capabilities.
Surelog Detail
Surelog DetailANETUSA Software Surelog is a cost-effective security information and event management software that collects, analyzes, searches, reports, and archives logs and security device data from a central location. It provides real-time event correlation, log search, alerting, and dashboard views to automate managing terabytes of machine-generated logs. Surelog supports many open source and commercial network firewalls, VPNs, proxies, and other security devices through agent-less log collection and analysis.
endpoint-detection-and-response-datasheet.pdf
endpoint-detection-and-response-datasheet.pdfOlufemi37 Symantec Endpoint Detection and Response (EDR) allows security teams to rapidly detect threats, investigate incidents, and remediate impacted endpoints through features like machine learning, global threat intelligence, automated playbooks, and memory analysis. EDR integrates with security tools to enhance visibility and automation. It can be deployed both on-premises and in the cloud to extend security for organizations of any size.
Security Monitoring Course - Ali Ahangari
Security Monitoring Course - Ali AhangariAli Ahangari This document outlines the topics and modules covered in a security monitoring course. Module 1 covers security monitoring fundamentals including components of a security operations center (SOC), the security monitoring process, and using Splunk as a security information and event management (SIEM) solution. Module 2 focuses on endpoint security monitoring on Windows and Linux systems. Module 3 covers network security monitoring including network protocols, firewalls, and intrusion detection. Module 4 discusses security monitoring functions such as incident response, threat intelligence, and automation.
IDS for Security Analysts: How to Get Actionable Insights from your IDS
IDS for Security Analysts: How to Get Actionable Insights from your IDSAlienVault The document discusses best practices for intrusion detection systems (IDS). It recommends a three phase process: collection, evaluation, and tuning. In the collection phase, an IDS gathers baseline data for 2 weeks. In evaluation, valuable and actionable events are identified based on policy, risk, and environment. Trending helps eliminate normal activity. Tuning removes unnecessary events to reduce false positives and save time through threshold adjusting and awareness of network details. Updates may require periodic re-evaluation and tuning to account for changes.
Best Practices for Configuring Your OSSIM Installation
Best Practices for Configuring Your OSSIM InstallationAlienVault Because every network environment is different, OSSIM offers flexibile configuration options to adapt to the needs of different environments. Whether you are just getting started with OSSIM, or have been using it for years, thinking through the configuration options availble will help you get the most out of your installation.
Join us for this customer training webcast where our OSSIM experts will walk through:
How to deploy & configure OSSEC agents
Best practices for configuring syslog and enabling plugins
Scanning your network for assets and vulnerabilities
Cisco Security Presentation
Cisco Security PresentationSimplex As the industry’s first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet, protecting all your users within minutes.
Cisco Advanced Malware Protection offers global threat intelligence, advanced sandboxing and real-time malware blocking to prevent breaches while it continuously analyzes file activity across your network, so that you can quickly detect, contain and remove advanced malware.
Presentation of Cisco Security Architecture and Solutions such as Cisco Advanced Malware Protection (AMP) and Cisco Umbrella during Simplex-Cisco Technology Session that took place at the Londa Hotel in Limassol on 14 March 2018.
Best Practices in IBM i Security
Best Practices in IBM i SecurityPrecisely Developing a Multi-Layered Defense for Your Systems and Data
Confidence in the security of your IBM i systems and data requires a solid understanding of potential vulnerabilities, the most effective best practices, and technologies that minimize the possibility of a data breach. We’ve grouped important security best practices and technologies into overlapping layers that provide multiple lines of defense. The ultimate goal is to always have another layer of security to thwart a would-be intruder.
Whether you are a systems security officer or an IBM i system administrator, you don’t want to miss this opportunity to learn about IBM i security best practices.
We’ll discuss:
• Common IBM i security vulnerabilities
• Configuring the security capabilities of the IBM i
• Implementing network security, access control, cryptography and more
Operational Security Intelligence
Operational Security IntelligenceSplunk You have spent a ton of money on your security infrastructure. But how do you string all those things together so you can achieve your goals of reducing time to response, detecting, preventing threats. And most importantly, having your security team serve your business and mission. Learn how to organize your security resources to get the best benefit. See a live demonstration of operationalizing those resources so your security teams can do more for your organization.
For Business's Sake, Let's focus on AppSec
For Business's Sake, Let's focus on AppSecLalit Kale Slide-Deck for session on Application Security at Limerick DotNet-Azure User Group on 15th Feb, 2018
Event URL: https://www.meetup.com/Limerick-DotNet/events/hzctdpyxdbtb/
Ad
More from AlienVault (20)
Meltdown and Spectre - How to Detect the Vulnerabilities and Exploits
Meltdown and Spectre - How to Detect the Vulnerabilities and ExploitsAlienVault As you've likely heard, Meltdown and Spectre are vulnerabilities that exist in Intel CPUs built since 1995. Hackers can exploit Meltdown and Spectre to get hold of information stored in the memory of other running programs. This might include passwords stored in a password manager or browser, photos, emails, instant messages and even business-critical documents.
Join us for a technical webcast to learn more about these threats, and how the security controls in AlienVault Unified Security Management (USM) can help you mitigate these threats.
You'll learn:
What the AlienVault Labs security research team has learned about these threats
How to scan your environment (cloud and on-premises) for the vulnerability with AlienVault USM Anywhere
How built-in intrusion detection capabilities of USM Anywhere can detect exploits of these vulnerabilities
How the incident response capabilities in USM Anywhere can help you mitigate attacks
Watch the On-Demand Webcast here: https://www.alienvault.com/resource-center/webcasts/meltdown-and-spectre-how-to-detect-the-vulnerabilities-and-exploits?utm_medium=Social&utm_source=SlideShare&utm_content=meltdown-spectre-webcast
Hosted By
Sacha Dawes
Principal Product Marketing Manager
Sacha joined AlienVault in Feb 2017, where he is responsible for the technical marketing of the AlienVault Unified Security Management (USM) family of solutions. He brings multiple years of experience from product management, product marketing and business management roles at Microsoft, NetIQ, Gemalto and Schlumberger where he has delivered both SaaS-delivered and boxed-product solutions that address the IT security, identity and management space. Originally from the UK, Sacha is based in Austin, TX.
Malware Invaders - Is Your OS at Risk?
Malware Invaders - Is Your OS at Risk?AlienVault Download this infographic to discover security vulnerabilities by operating system.
Simplify PCI DSS Compliance with AlienVault USM
Simplify PCI DSS Compliance with AlienVault USMAlienVault Learn about common challenges in PCI DSS compliance and how to use AlienVault USM to overcome them more easily.
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...
SIEM for Beginners: Everything You Wanted to Know About Log Management but We...AlienVault This document provides an overview of log management and security information and event management (SIEM). It explains that SIEM systems evolved from separate technologies like log management systems, security log/event management, security information management, and security event correlation. A SIEM system provides centralized log collection, normalization, storage, and analysis. It allows security events from different systems to be correlated to detect patterns and automated threats. The document emphasizes that SIEM provides context around security events to help analysts investigate incidents.
Insider Threat Detection Recommendations
Insider Threat Detection RecommendationsAlienVault Read this white paper to learn what an insider threat is, types of insider threats, and the different tools and techniques used to detect them.
Alienvault threat alerts in spiceworks
Alienvault threat alerts in spiceworksAlienVault AlienVault Threat Alerts are a simple yet powerful tool that comes built-in with Spiceworks. When a device on your network has been interacting with a known malicious host or suspicious IP, you’ll immediately get an alert in your feed and you’ll get an alert email.
Open Source IDS Tools: A Beginner's Guide
Open Source IDS Tools: A Beginner's GuideAlienVault The document provides an overview of several open source intrusion detection tools, including Snort, Suricata, Bro, Kismet, OSSEC, Samhain, and OpenDLP. It discusses the types of detection each tool performs, such as signature-based detection for Snort and Suricata, and behavior analysis for Bro. It also outlines advantages of each tool, such as Suricata's ability to use hardware acceleration and multi-threading. Finally, it recommends the Security Onion distribution for testing various open source IDS tools together.
Malware detection how to spot infections early with alien vault usm
Malware detection how to spot infections early with alien vault usmAlienVault Learn about common type of malware such as rootkit, backdoor/RAT and ransomware and how to detect them with AlienVault USM.
Security operations center 5 security controls
Security operations center 5 security controlsAlienVault An effective Security Operation Center provides the information necessary for organizations to efficiently detect threats and subsequently contain them. While eliminating the threats we face is an impossible goal, reducing the time it takes to respond and contain them is certainly achievable. Learn 5 security controls for an effective security operations center.
PCI DSS Implementation: A Five Step Guide
PCI DSS Implementation: A Five Step GuideAlienVault Payment Card Industry Data Security Standard (PCI DSS) compliance can be both hard and expensive. For most small to medium sized organizations, it doesn’t have to be as long you have the right plan and tools in place. In this guide you’ll learn five steps that you can take to implement and maintain PCI DSS compliance at your organization.
AlienVault PCI DSS Compliance:
https://www.alienvault.com/solutions/pci-dss-compliance
Have a question? Ask it in our forum:
http://forums.alienvault.com
More videos: http://www.youtube.com/user/alienvaulttv
AlienVault Blogs: http://www.alienvault.com/blogs
AlienVault: http://www.alienvault.com
The State of Incident Response - INFOGRAPHIC
The State of Incident Response - INFOGRAPHICAlienVault Incident Response (IR) teams are designed to detect, investigate and, when necessary, perform remediation in the event of a critical incident. The results of the 2015 SANS Incident Response Survey provides a picture of what IR teams are up against today—the types of attacks they see, what defenses they have in place to detect and respond to these threats, and their perceived effectiveness and obstacles to incident handling.
Some key challenges reported by responders to the survey were:
66% cited a skills shortage as being an impediment to effective IR:
54% cited budgetary shortages for tools and technology
45% noted lack of visibility into system or domain events
41% noted a lack of procedural reviews and practice
37% have trouble distinguishing malicious events from nonevents
Do these challenges sound familiar? Download the full survey to learn more about how other organizations are approaching incident response, along with best practices and advice. Visit http://ow.ly/R3Cr0
Incident response live demo slides final
Incident response live demo slides finalAlienVault So, you've got an alarm - or 400 alarms maybe, now what? Security incident investigations can take many paths leading to incident response, a false positive or something else entirely. Join this webcast to see security experts from AlienVault and Castra Consulting work on real security events (well, real at one point), and perform real investigations, using AlienVault USM as the investigative tool. Process or art form? Yes.
You'll learn:
Tips for assessing context for the investigation
How to spend your time doing the right things
How to to classify alarms, rule out false positives and improve tuning
The value of documentation for effective incident response and security controls
How to speed security incident investigation and response with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USM
Improve Situational Awareness for Federal Government with AlienVault USMAlienVault Securing your network from threats is a constantly evolving challenge, especially for federal government agencies with much valuable data to protect, and where IT security resources are often limited. AlienVault has helped many government organizations get complete security visbility for effective threat detection and response, without breaking the bank.
Join us for a live demo to see how AlienVault USM addresses these key IT security needs:
Discover all IP-enabled assets to get an accurate picture of attack surface
Identify vulnerabilities like insecure configurations and unpatched software
Improve situational awareness with real-time threat detection and alerting
Speed incident containment & response with built-in remediation guidance for every alert
Investigate anomalies in protocol usage, privilege escalation, host behavior and more
Generate fast & accurate reports for compliance & management
Improve Security Visibility with AlienVault USM Correlation Directives
Improve Security Visibility with AlienVault USM Correlation DirectivesAlienVault At the heart of SIEM is ability to correlate events from one or many sources into actionable alarms based on your security policies. AlienVault USM provides over 2100 correlation directives developed by the AlienVault Labs team, plus the ability to create your own custom rules.
Join us for this customer training session covering how to:
Ensure you are using the latest and greatest built-in correlation directives from AlienVault Labs
Write your own correlation directives based on events from one or more sources
Turn correlation information into actionable alarms
Use correlations to enforce your security policies
How Malware Works
How Malware WorksAlienVault With malware accounting for at least 40% of all breaches, knowing how malware works can be an extremely valuable asset in your threat detection cache – especially for the incident responder. According to Verizon’s 2013 Data Breach Investigations Report, “Malware and hacking still rank as the most common [threat] actions”. In general, malware can range from being simple annoyances like pop-up advertising to causing serious damage like stealing passwords and data or infecting other machines on the network.
Malware is as old as software itself and although there are new types of malware constantly under development, they generally fall into a few broad categories. Check out this SlideShare to learn how malware works, and what we believe are the most common types of malware you should be prepared for.
By learning how malware works and recognizing its different types, you’ll understand:
- How they find their way into your network
- How attackers control them remotely
- How they use your systems for nefarious purposes
- And most importantly, the security controls you need to effectively defend against and detect malware infections. (Hint: you need more than antivirus!)
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than Ever
New USM v5.0 - Get Complete Security Visibility Faster & Easier Than EverAlienVault AlienVault Unified Security Management™ (USM) integrates SIEM/event correlation with built-in tools for intrusion detection, asset discovery, vulnerability assessment and behavioral monitoring to give you a unified, real-time view of threats in your environment. NEW v5.0 (available 4/20) makes it faster and easier than ever to get the insights you need, starting on Day 1.
Join us for a live demo to see how new USM v5.0 makes it easier than ever to accomplish these key tasks:
Discover all IP-enabled assets on your network
Identify vulnerabilities like unpatched software or insecure configurations
Detect network scans and malware like botnets, trojans & rootkits
Speed incident response with built-in remediation guidance for every alert
Generate accurate compliance reports for PCI DSS, HIPAA and more
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than Ever
New OSSIM v5.0 - Get Security Visibility Faster & Easier Than EverAlienVault With a focus on simplifying asset management, OSSIM v5.0 (available 4/20) makes it faster and easier than ever to get the insights you need. Join us for this user training to learn how to get the most out of these new enhancements:
Assign custom labels for assets, groups and networks
Search, filter and group assets by OS, IP address, device type, custom labels and more
Run vulnerability and asset scans on custom asset groups with one click
Filter by asset groups in alarms, security events and raw logs
Update configuration, sensor assignment, asset value and more on multiple assets and groups of assets at once
...and more!
AWS Security Best Practices for Effective Threat Detection & Response
AWS Security Best Practices for Effective Threat Detection & ResponseAlienVault In this SlideShare, we’ll share the AWS Security Best Practices for securing AWS environments, as well as some of the trends our research has shown with regard to attacks on those environments. We'll also introduce the key capabilities needed for a modern threat detection & incident response program customized for AWS, and other AWS Security Best Practices including:
-Asset Discovery - creating an inventory of running instances
-Vulnerability Assessment - conducting scans to assess exposure to attack, and prioritize risks
-Change Management - detect changes in your AWS environment and insecure network access control configurations
-S3 & ELB Access Log Monitoring - Monitor access logs of hosted content and data directed at your instance
-CloudTrail Monitoring and Alerting - Monitor the CloudTrail service for abnormal behavior
-Windows Event Monitoring - Analyze system level behavior to detect advanced threats
With more IT environments moving data and applications to AWS, the motivation for hackers to target AWS environments is also increasing. We believe these AWS Security Best Practices will be a valuable addition to every security practitioner’s playbook.
We'll finish up with a demo of NEW AlienVault USM for AWS, which delivers all of the above capabilities, plus log management & event correlation to help you detect threats quickly and comply with regulatory requirements.
Insider Threats: How to Spot Trouble Quickly with AlienVault USM
Insider Threats: How to Spot Trouble Quickly with AlienVault USMAlienVault There's always a need to stop bad stuff from coming in, but it's important to remember that those inside the firewall can pose an even bigger risk to your network security. Whether its unsuspecting users clicking on phishing e-mails, someone running bit torrent in your datacenter, or a truly malicious user out to sabotage the network, insider threats can really keep you up at night.
Join us for this technical demo showing how USM can help you detect:
Malware infections on end-user machines
Insiders misusing network resources
Privileged users engaging in suspicious behaviors
Alien vault sans cyber threat intelligence
Alien vault sans cyber threat intelligenceAlienVault Over the last several years, we have seen that attackers are innovating much faster than defenders are. This trend is steering many companies to look towards cyber threat intelligence (CTI) to help them navigate today’s threatening landscape. SANS conducted a survey this year to explore who is using cyber threat intelligence and how they are using it. The survey collected responses from 326 IT professionals working in a variety of industries, in all sizes and from many different regions. 69% of the respondents reported implementing CTI to some extent, with only 16% planning not to pursue CTI in their environments. Which side of this percentage do you fall into? The infographic below provides some of the key questions to ask when getting started with threat intelligence, along with data from the SANS survey to show you how others are using threat intelligence.
Ad
Improve Threat Detection with OSSEC and AlienVault USM
- 2. About AlienVault AlienVault has unified the security products, intelligence and community essential for mid-sized businesses to defend against today’s modern threats
- 3. Agenda OSSEC capabilities AlienVault USM capabilities Demo – See it in action • Remote OSSEC agent deployment, configuration and management • Behavioral monitoring of servers and workstations • Logging and reporting for PCI compliance • Data correlation with IP reputation data, vulnerability scans and more • Correlating OSSEC events to detect attacks
- 4. OSSEC & AlienVault USM Learning the Basics…
- 5. OSSEC capabilities Log analysis based intrusion detection File integrity checking Registry keys integrity checking (Windows) Signature based malware/rootkits detection Real-time alerting and active response
- 6. OSSEC Architecture Agent components: Logcollectord: Read logs (syslog, WMI, flat files) Syscheckd: File integrity checking Rootcheckd: Malware and rootkits detection Agentd: Forwards data to the server Server components: Remoted: Receives data from agents Analysisd: Processes data (main process) Monitord: Monitor agents
- 7. ASSET DISCOVERY • Active Network Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory VULNERABILITY ASSESSMENT • Continuous Vulnerability Monitoring • Authenticated / Unauthenticated Active Scanning BEHAVIORAL MONITORING • Log Collection • Netflow Analysis • Service Availability Monitoring SECURITY INTELLIGENCE/SIEM • SIEM Event Correlation • Incident Response THREAT DETECTION • Network IDS • Host IDS • File Integrity Monitoring USM Platform Integrated, Essential Security Controls
- 8. AlienVault USM Architecture Embedded tools: Asset discovery: Nmap, Prads Behavioral monitoring: Netflow, Ntop, Nagios Threat detection: Snort, Suricata, OSSEC Vulnerability assessment: OpenVas External collectors: Syslog WMI SDEE
- 9. AlienVault Event Correlation AlienVault USM correlates events from multiple sources, crossing OSSEC alerts with information collected from embedded detectors and external sources.
- 10. OSSEC Management Interface • Status monitor • Events viewer • Agents control manager • Configuration manager • Rules viewer/editor • Logs viewer • Server control manager • Deployment manager • Rules viewer/editor AlienVault USM provides a comprehensive GUI for OSSEC alerts management:
- 11. Let’s See It In Action
- 12. 888.613.6023 ALIENVAULT.COM CONTACT US [email protected] Test Drive AlienVault USM Download a Free 30-Day Trial http://www.alienvault.com/free-trial Try our Interactive Demo Site http://www.alienvault.com/live-demo-site Now for some Q&A.. Questions? [email protected] Twitter : @alienvault