McGyver's SIEM -- Building the best free HUD

McGyver’s SIEM
Building the best free HUD

Wim Remes

Thursday 21 October 2010

What we won’t need today ...


The views and opinions expressed in this presentation are
those of the presenter and do not reﬂect those of past,
current or future employers, associates or clients.


FOSS will never ever provide you with a complete SIEM
solution. Implementing SIEM is hard work and requires
dedication and vision. The premise of this talk is to enable
you to build the skillset required to implement a SIEM solution and
for you to understand your needs using free and open source software.
With that skillset you will then be enabled to to make an informed choice, lower the
actual implementation cost and improve ROI.

More importantly, it will teach your technical people how to
interpret data, build use cases and apply a common-sensical methodology.

Instead of making them button-clicking drones (again),
here’s your chance to make your people the strongest link not the weakest.


Who am I ?

Wim Remes

Ernst & Young (Belgium)

infosecmentors.com

eurotrashsecurity.eu


What is this about ?

1. What is SIEM ?
2. A common-sensical approach.
3. Let’s get it on !
4. Ask away ...


1
What is SIEM ?
(Deﬁnition)


Security Information & Event Management

Software/Hardware that gathers, analyzes and presents
information from multiple sources
of security-relevant data.
(thanks to wikipedia)


SIEM
Log Management
Security Information & Event Management

SEM SIM
ESIM

(+ everything your vendor wants it or it’s name to be)


DATA INFORMATION


Information
Knowledge
Understanding

Wisdom


1
What is SIEM ?
(Functionality we want)


Collection

syslog

scp

ftp


Normalization
FW_1 I dropped a packet from x to z on port 80 at 13:22
time : 13:22
action : dropped
source: x
destination : z
port : 80

FW_2 rejected x:1234 to z:22 at 1:23pm
time : 13:23
action : dropped
source: x
destination : z
port : 22


Correlation
time : 04:22 time : 04:23 time : 04:24 time : 04:25
action : failed action : failed action : failed action : success
src_ip : a.b.c.d src_ip : a.b.c.d src_ip : a.b.c.d src_ip : a.b.c.d
user : craig user : craig user : craig user : craig

Brute-force
attack ? Brute-force
(look at this in the morning) attack ?
(wake the f* up now !)


3 base use cases

React Faster

Improve Efficiency

Automate Compliance

Securosis : Understanding and Selecting SIEM/Log Management


2
common-sensical approach


Architecture

FLAT


Architecture

HIERARCHICAL


Architecture

MESH


integrating SIEM

Data Sources

Data Points
Use Cases


3
Let’s get it on !


Our arsenal

ossec
http://www.ossec.net ossim
http://www.alienvault.com

syslog-ng
http://www.balabit.com/network-security/syslog-ng

davix
http://www.secviz.org

(+ some golden nuggets)


OSSEC
Host Based Intrusion Detection/Prevention

- Log Monitoring
- Integrity Control & Host Checking
- Policy Monitoring
- Real-time alerting & Active Response

Running on :
Windows, AIX,Solaris,HP-UX,MacOS & Linux


OSSEC

ossec-logcollector

agentd remoted

analysisd
Client
maild execd

Server


OSSEC
SIEM

OSSEC OSSEC
agentless !

syslog

= OSSEC agent

* observation : none of the leading SIEM solutions support OSSEC as an event source out of the box, why ?


OSSEC

pre-decoding

decoding

signatures


OSSEC
palo alto threat detection

Aug 26 13:56:07 192.168.0.5 1,2010/08/26 13:56:07,0003A100245,THREAT,
vulnerability,8,2010/08/26 13:56:01,10.0.0.1,10.0.0.2,0.0.0.0,
0.0.0.0,rule2,domainuser,,netbios-ns,vsys1,TAP-ZONE,TAP-ZONE,ethernet1/1,
ethernet1/1,Logger,2010/08/26 13:56:07,136674,3,137,137,0,0,0x8000,udp,
alert,"",NetBIOS nbtstat query(31707),any,low,client-to-server

thanks to Xavier Mertens (@xme)

OSSEC
(decoder)

<-- Custom decoder for PaloAlto Firewalls Threat Events -->
<decoder name="paloalto-threat">
<prematch>^d,dddd/dd/dd dd:dd:dd,.+,THREAT,</prematch>
<regex>(d+.d+.d+.d+),(d+.d+.d+.d+),d+.d+.d+.d+,d+.d+.d+.d+,.+,(.*),(.*),.+,alert,.+,(.+),.
+$</regex>
<order>srcip,dstip,srcuser,dstuser,extra_data</order>
</decoder>


OSSEC
(rules)
<group name="syslog,paloalto-threat,">
<rule id="150000" level="0">
<decoded_as>paloalto-threat</decoded_as>
<description>PaloAlto Firewalls Threat Events</description>
</rule>

<rule id="150001" level="10">
<if_sid>150000</if_sid>
<match>NetBIOs</match>
<description>Possible NetBIOS attack detected!</description>
</rule>

<rule id="150002" level="10">
<if_sid>150000</if_sid>
<user>domainadministrator</user>
<description>Possible attack detected against Administrator!</description>
</rule>
</group>


OSSEC
rules

login

failed success

100 times in
from unauthorized
the last 10
ip address !
minutes

on critical
server wake the f* up !


OSSEC
rules

login

failed success

100 times in
from unauthorized
the last 10 AR ip address !
minutes

on critical
server
AR don’t bother, everything is
under control

OSSIM
(includes OSSEC)

front < you are here !
end

normalization, prioritization,
DB server collection, risk assessment,
correlation, ...

snort, nessus, Spade, p0f,
Ntop, arpwatch, OSSEC, ... sensor sensor sensor


OSSIM
risk maps


OSSIM
compliance reporting


OSSIM
event analysis


OSSIM
incident response


3
Let’s get it on !
a few words on data visualization
(because it’s important !)


Choosing the right chart !

http://ebiquity.umbc.edu/blogger/2009/01/25/how-to-choose-the-right-chart-for-your-data/


DAVIX
Data visualization Live CD

- free data processing and visualization tools
- Bootable CD
- available from http://www.secviz.org
- part of “Applied Security Visualization” by
Raffael Marty


a firewall log treemap

source : http://www.secviz.org


radial firewall visualization



windows event log types



1 day of firewall logs



gl-tail

http://www.fudgie.org/


Recap

Focus on approach, not tools

Use open source to facilitate & learn

Integrate in architecture later


Thank you !
interesting people to follow :
@andrewsmhay
@zrlram
@anton_chuvakin
@rockyd
@xme

podcast :
wremes@gmail.com LogChat (see Anton’s blog or iTunes)
@wimremes websites :
http://www.securosis.com
http://www.secviz.org
http://www.ossec.net
http://www.alienvault.com
http://chuvakin.blogspot.com/
http://blog.rootshell.be
http://www.decurity.com


McGyver's SIEM -- Building the best free HUD

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (19)

Más de wremes

Más de wremes (20)

Último

Último (20)

McGyver's SIEM -- Building the best free HUD