Foreword |
|
xxi | |
Acknowledgments |
|
xxiii | |
Introduction |
|
xxv | |
|
Part I Introduction to SIEM: Threat Intelligence for IT Systems |
|
|
|
|
3 | (16) |
|
What Are It Business Models? |
|
|
4 | (1) |
|
What You Have to Worry About |
|
|
5 | (4) |
|
|
9 | (1) |
|
|
10 | (4) |
|
|
10 | (2) |
|
|
12 | (1) |
|
Social Services Infrastructure |
|
|
13 | (1) |
|
|
14 | (2) |
|
|
14 | (1) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (2) |
|
How Does Your Company's Business Model Affect You? |
|
|
18 | (1) |
|
|
19 | (16) |
|
The Bad Things That Could Happen |
|
|
21 | (4) |
|
|
21 | (2) |
|
|
23 | (2) |
|
Recognizing Attacks on the IT Systems |
|
|
25 | (8) |
|
Scanning or Reconnaissance |
|
|
26 | (3) |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (2) |
|
|
35 | (18) |
|
|
38 | (3) |
|
Sarbanes-Oxley Act (2002) - SOX |
|
|
38 | (1) |
|
Gramm-Leach-Bliley Act (1999) - GLBA |
|
|
38 | (1) |
|
Healthcared Insurance Portability and Accountability Act (1996)-HIPAA |
|
|
39 | (1) |
|
Payment Card Industry Data Security Standard - PCIDSS |
|
|
39 | (1) |
|
California Senate Bill 1386 (2003) - CA SB1386 |
|
|
40 | (1) |
|
Federal Information Security Management Act (2002) - FISMa |
|
|
40 | (1) |
|
Cyber Security Act of 2009 (SB 773) |
|
|
40 | (1) |
|
Recommended Best Practices |
|
|
41 | (1) |
|
|
42 | (7) |
|
|
49 | (4) |
|
Part II It Threat Intelligence Using SIEM Systems |
|
|
|
4 SIEM Concepts: Components for Small and Medium-size Businesses |
|
|
53 | (24) |
|
|
54 | (1) |
|
|
55 | (8) |
|
|
56 | (1) |
|
|
56 | (1) |
|
|
56 | (1) |
|
Vulnerabililty Assessment Data |
|
|
57 | (1) |
|
|
57 | (3) |
|
|
60 | (3) |
|
|
63 | (4) |
|
|
64 | (1) |
|
|
65 | (1) |
|
|
65 | (2) |
|
|
67 | (4) |
|
|
67 | (3) |
|
Protecting lthe Network from the Endpoints |
|
|
70 | (1) |
|
|
71 | (3) |
|
|
73 | (1) |
|
Implementation Methodology |
|
|
74 | (1) |
|
|
75 | (1) |
|
|
76 | (1) |
|
|
77 | (16) |
|
|
78 | (3) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
|
Determining Needed SIEM Resources |
|
|
80 | (2) |
|
|
81 | (3) |
|
|
82 | (1) |
|
|
82 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
83 | (1) |
|
Parsing.Normalization of Logs |
|
|
84 | (2) |
|
Rule Engine/Correlation Engine |
|
|
86 | (4) |
|
|
87 | (3) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
91 | (1) |
|
|
91 | (1) |
|
|
92 | (1) |
|
|
93 | (22) |
|
What Is an Incident Response Program? |
|
|
94 | (3) |
|
Grown from ;the Security Program |
|
|
94 | (2) |
|
Where the IR Program Fits In |
|
|
96 | (1) |
|
How to Build and Incident Response Program |
|
|
97 | (4) |
|
|
97 | (2) |
|
Useful Tools for the IR Team |
|
|
99 | (1) |
|
|
100 | (1) |
|
|
100 | (1) |
|
Security Incidents and a Guide to Incident Response |
|
|
101 | (10) |
|
A Typical Escalation Flow to Security Incident |
|
|
101 | (1) |
|
|
102 | (2) |
|
Incident Response Procedures |
|
|
104 | (7) |
|
|
111 | (3) |
|
Automated Response---a Good Thing |
|
|
112 | (1) |
|
Automated Response---a Bad Thing |
|
|
113 | (1) |
|
|
114 | (1) |
|
7 Using SIEM for Business Intelligence |
|
|
115 | (24) |
|
What Is Business Intelligence |
|
|
116 | (3) |
|
Business Intelligence Terminology |
|
|
117 | (2) |
|
Common Business Intelligence Questions |
|
|
119 | (12) |
|
Answers to the Common Business Intelligence Questions |
|
|
119 | (11) |
|
Developing Business Intelligence Strategies Using SIEM |
|
|
130 | (1) |
|
How to Utilize SIEM for Your BI Objectives |
|
|
131 | (4) |
|
Using the Data that Your Organization Currently Possesses |
|
|
132 | (2) |
|
What Other Companies Are Doing with SIEM and BI |
|
|
134 | (1) |
|
|
135 | (4) |
|
|
|
8 Alien Vault OSSIM Implementation |
|
|
139 | (30) |
|
|
140 | (7) |
|
|
140 | (1) |
|
|
140 | (2) |
|
|
142 | (4) |
|
|
146 | (1) |
|
|
147 | (2) |
|
|
147 | (2) |
|
Deployment Considerations |
|
|
149 | (1) |
|
|
149 | (17) |
|
|
150 | (1) |
|
|
151 | (14) |
|
|
165 | (1) |
|
Modifications After Istallation |
|
|
165 | (1) |
|
|
166 | (2) |
|
|
166 | (1) |
|
|
166 | (1) |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
167 | (1) |
|
|
168 | (1) |
|
|
168 | (1) |
|
|
168 | (1) |
|
9 Alien Vault OSSIM Operation |
|
|
169 | (28) |
|
|
170 | (15) |
|
|
170 | (4) |
|
|
174 | (4) |
|
|
178 | (3) |
|
|
181 | (1) |
|
|
182 | (2) |
|
|
184 | (1) |
|
Analysis of a Basic Attack |
|
|
185 | (5) |
|
Analysis of a Sophisticated Attack |
|
|
190 | (5) |
|
|
195 | (2) |
|
10 Cisco Security: MARS Implementation |
|
|
197 | (28) |
|
|
198 | (4) |
|
Topology, Sessions, and Incidents |
|
|
199 | (2) |
|
Scaling a MARS Deployment |
|
|
201 | (1) |
|
|
202 | (3) |
|
|
202 | (1) |
|
|
203 | (1) |
|
|
204 | (1) |
|
|
205 | (1) |
|
Resources and Requirements |
|
|
205 | (1) |
|
Roles and Responsibilities |
|
|
206 | (1) |
|
|
206 | (10) |
|
Installing the Device and Connect to Network |
|
|
206 | (2) |
|
Configuring the Web Interface |
|
|
208 | (1) |
|
Assigning the Web Interface |
|
|
208 | (1) |
|
Assigning MARS User Accounts |
|
|
208 | (1) |
|
|
209 | (3) |
|
|
212 | (1) |
|
|
212 | (4) |
|
Operation: Queries, Rules, and Reports |
|
|
216 | (7) |
|
|
217 | (1) |
|
|
218 | (2) |
|
|
220 | (1) |
|
|
221 | (2) |
|
|
223 | (1) |
|
|
223 | (2) |
|
11 Cisco MARS Advanced Techniques |
|
|
225 | (36) |
|
|
226 | (17) |
|
|
228 | (5) |
|
|
233 | (1) |
|
|
234 | (1) |
|
|
235 | (3) |
|
|
238 | (2) |
|
|
240 | (3) |
|
Adding Unsupported Devices to MARS |
|
|
243 | (9) |
|
Importing Device Support Packages |
|
|
244 | (2) |
|
Building Your Own Custom Parsers |
|
|
246 | (6) |
|
A Typical Day in the Life of a MARS Operator |
|
|
252 | (7) |
|
|
259 | (1) |
|
|
259 | (2) |
|
12 Q1 Labs ORadar Implementation |
|
|
261 | (28) |
|
QRadar Architecture Overview |
|
|
262 | (4) |
|
|
266 | (1) |
|
|
267 | (3) |
|
|
267 | (1) |
|
Plan Your ORadar SIEM Deployment |
|
|
268 | (2) |
|
|
270 | (15) |
|
Configuring the Underlying CentOS System |
|
|
270 | (1) |
|
The ORadar Administrative Interface |
|
|
271 | (14) |
|
Getting Flow and Event Data into ORadar |
|
|
285 | (2) |
|
|
286 | (1) |
|
|
287 | (1) |
|
|
287 | (2) |
|
13 Q1 Labs QRadar Advanced Techniques |
|
|
289 | (40) |
|
Using the ORadar Dashboard |
|
|
291 | (8) |
|
ORadar Dashboard Default Views |
|
|
292 | (1) |
|
|
292 | (3) |
|
|
295 | (1) |
|
|
296 | (3) |
|
|
299 | (2) |
|
|
300 | (1) |
|
|
300 | (1) |
|
|
301 | (6) |
|
|
302 | (1) |
|
ORadar Custom Rules Wizard |
|
|
303 | (4) |
|
|
307 | (2) |
|
Searching ORadar Offenses |
|
|
308 | (1) |
|
|
309 | (8) |
|
ORadar False Positive Wizard |
|
|
309 | (2) |
|
ORadar DSMs and Custom DSMs |
|
|
311 | (3) |
|
Replacing the ORadar SSL Certificates |
|
|
314 | (3) |
|
Stepping Through the Process |
|
|
317 | (10) |
|
|
317 | (10) |
|
|
327 | (2) |
|
14 ArcSight ESM v4.5 Implementation |
|
|
329 | (26) |
|
ArcSight Terminology and Concepts |
|
|
330 | (1) |
|
Overview of ArcSight Products |
|
|
331 | (6) |
|
|
332 | (3) |
|
|
335 | (1) |
|
|
336 | (1) |
|
|
336 | (1) |
|
ArcSight ESM v4.5 Architecture Overview |
|
|
337 | (3) |
|
|
340 | (2) |
|
|
340 | (1) |
|
|
341 | (1) |
|
Determine ArcSight Hardware Requrements |
|
|
341 | (1) |
|
|
342 | (12) |
|
|
343 | (1) |
|
Install and Configure Operating System |
|
|
343 | (1) |
|
Install ArcSight ESM v4.5 Database Software and Oracle Database |
|
|
344 | (4) |
|
Install ArcSight ESM v4.5 Manager |
|
|
348 | (2) |
|
Configure ArcSight Partition Archiver |
|
|
350 | (1) |
|
Install ArcSight SmartConnector |
|
|
351 | (2) |
|
|
353 | (1) |
|
|
354 | (1) |
|
15 ArcSight ESM v4.5 Advanced Techniques |
|
|
355 | (28) |
|
Operations: Dealing with Data |
|
|
356 | (9) |
|
|
356 | (1) |
|
|
357 | (3) |
|
|
360 | (1) |
|
|
360 | (1) |
|
|
361 | (2) |
|
|
363 | (1) |
|
|
364 | (1) |
|
|
364 | (1) |
|
Managing Assets and Networks |
|
|
365 | (3) |
|
The ArcSight SmartConnector |
|
|
365 | (1) |
|
|
366 | (1) |
|
The ArcSight Network Modeld |
|
|
367 | (1) |
|
Management and Troubleshooting |
|
|
368 | (13) |
|
Log and Configuration Files |
|
|
368 | (5) |
|
|
373 | (3) |
|
System Patching and Upgrades |
|
|
376 | (3) |
|
|
379 | (2) |
|
|
381 | (2) |
Appendix: The Ways and Means of the Security Analyst |
|
383 | (32) |
Index |
|
415 | |