Please enable JavaScript.

Coggle requires JavaScript to display documents.

EDR, FIM, Qradar, OSSEC Server, DIS-SW / (CORE), DIS-SW / (CORE), (methods…

- - - - ISP-B
        secondary
      - ISP-A
        primary
- - - - ISP-A
        primary
      - ISP-B
        secondary
- - - - Event Processor
        
        Magistrate(console)
        
        After Events are normalized they are then sent to the Event Processor for processing
      - Asset Profiler
      - Responsible for parsing and normalizing incoming Events
    - - For vulnerability assessment (VA) and maintaining asset profiles, QRadar SIEM can also integrate with many active scanners
        
        You can schedule Nessus, Nmap, and IBM Security QRadar Vulnerability Manager scanner directly in QRadar SIEM
        
        For other scanners, you schedule only the collection of scan results in QRadar SIEM but not the scan itself
      - Vuln integration
        services
- - - - FAM
        service
        
        File
        Crawler
        
        file crawler – ICM process responsible for scan of file system and file metadata generation
        
        Analysis
        Engine
        
        ICM
        Server
        
        ICM server – ICM process responsible for classification task management and configuration upload interface for ICM workbench
        
        ICM Workbench
        
        ICM workbench – Windows application to create own classification rules (decision plans)
        
        analysis engine – rule based classification tool for files
        
        Feed service to collector from ICM (IBM Content Classification) infrastructure
      - S-TAP
        service
        
        WFP
        
        new sniffer driver for TCP/IP stack
        
        WPM
        
        new sniffer driver for shared memory
        
        communication with collector and data proxy for sniffer drivers (WFP, NPM) – DAM functionality
      - FS-TAP
        service
        
        FSM
        
        FS-TAP (or STAPat) – service responsible for communication with collector and data proxy for I/O sniffer (FSMonitor) driver – FAM functionality
      - 16017
        
        CAS
        java
        service
        
        CAS (Change Audit System) – java based service responsible for identification the changes in the critical elements of database and operating system
      - 50000
  - - - GIM
        perl service
        
        GIM (Guardium Installation Manager) – service based on Perl responsible for installation, update and configuration all other elements working on monitored system
- - - - Veaam VMs
    - - Veaam Backup Proxy
        
        Backup Repository
        
        SAN
        
        Storage
- - - - Analysisd
        
        Decode
        
        Rules
        
        Alerts
      - Agent
      - Agent
- - - - Execd
- - - - Remoted
        
        Decrypted
        data
- - - - alerts.json
      - archives.json
        
        Filebeat
        
        Elk
        
        W. indexer
        
        Search engine
        Data Analytics
- - - - Plugins
        
        Plugins are of two types: detectors, which detect anomalies and possible attacks (such as Snort, P0f, Arpwatch), and monitors to monitor the network status (like Ntop and Nagios).
      - TCP 40001
        
        OSSIM-SERVER
        
        Reputation
        
        Risk
        
        taxonomy
        
        Correlation
        
        event database
        
        Ossim-framework
        
        WEB UI
        
        1 more item...
        
        The Database is a MySQL server instance that stores events and system configuration data.
        
        The Server performs the essential SIEM functions: aggregation, risk assessment and correlation of events that are received from the sensor through TCP port 40001. The server also sends the information concerning the events to the Database for storage.
      - The Ossim-agent, using a series of modules called plugins, one for each type of log, performs log analysis and normalization, and sends that to the Server component.
- - - - Ariel Proxy server
      - Accumulator
      - Ariel Query Server
      - Historical Correlation
      - Offline forwarder
      - Report Runner
- - - - Throttle Filter
        
        Coalescing
        
        Event Forwarding
        
        Asset Profiler
        
        QRadar SIEM maintains asset profiles for systems in the network; the profiles track host details, such as these examples
        
        IP addresses
        
        Services listening on open ports
        
        Vulnerabilities
        
        Applies routing rules for the system, such as sending event data to offsite targets, external Syslog systems, JSON systems, and other SIEMs.
        
        Event Coalescing is a method of reducing the data going through the pipeline. - As data arrives in the pipeline QRadar will attempt to group like events together into a single event.
        Coalescing is indexed by Log Source, QID, Source IP, Destination IP, Destination Port and Username.
        If more than 4 events arrive within a 10 second window with these properties being identical any additional events beyond the 4th will be collapsed together.
        for example, a good explanation for multiple alerts in a short time is same incident happened too many times and this prevented with this feature of Qradar.
        
        Licensing - On a second-by-second basis,
        slows down the incoming rate so it does not exceed the license on the appliance.
        
        Parsing
        
        – DSMs / LSX / CEP – take the raw data and normalize it into a common structure.
      - – Reads or pulls raw data from network devices (e.g: Windows Servers, Firewalls, etc)
  - - - Flow Governor
        
        CFP Parsing
        
        Flow Forwarding
        
        Event Processor
        
        Magistrate (console)
- - - - Entry Router (Licensing)
        
        Custom rules Engine
        
        Storage and
        Indexing
        
        Ariel
        
        Ariel Query Server
        
        Historical Correlation
        
        Tomcat
        
        1 more item...
        
        Process that is responsible for historical correlation. Runs a specified search, runs the results through CRE rules (based on QRadar time or device time) and generates offenses
        
        Report Runner
        
        Report Executor
        
        2 more items...
        
        A stopwatch responsible for keeping track of reports and when they should run and then instantiating the report runner
        
        Offline forwarder
        
        Accumulator
        
        Host Profiling
        
        RealTIme Streaming
        
        Magistrate(console)
        
        1 more item...
        
        Asset Profiler
        
        postgresql
        
        1 more item...
- - - - Ipsec/ssl/vpn tunnel packet ?
        
        Fw Fastpath
        
        Firewall Session Lookup
        
        Fw session Setup/Slowpath
        
        Forwarding Lookup
        
        NAT Policy Lookup
        
        1 more item...
        
        L2-4 Firewall Processing
        
        SSL proxy - decrypt packet if applicable
        
        Session App Identified ?
        
        2 more items...
        
        A packet that matches an existing session will enter the fast path. This stage starts with Layer-2 to Layer-4 firewall processing:
        
        Security Processing
        A packet matching an existing session is subject to further processing (application identification and/or content inspection) if packet has TCP/UDP data (payload), or it is a non-TCP/UDP packet .
        
        If the firewall does not detect the session application, it performs an App-ID lookup. If App-ID lookup is non-conclusive, the content inspection module runs known protocol decoder checks and heuristics to help identify the application.
        
        The firewall performs the following steps to set up a firewall session :
        
        Zone Protection Checks
        
        TCP State Check
        
        Forwarding Setup
        
        NAT Policy Lookup
        
        User-ID
        
        DoS Protection Policy Lookup
        
        Security Policy Lookup
        
        Session Allocation
        
        If the packet is subject to firewall inspection, it performs a flow lookup on the packet. A firewall session consists of two unidirectional flows, each uniquely identified. In PAN-OS ’s implementation, the firewall identifies the flow using a 6-tuple key:
        
        A packet is subject to firewall processing depending on the packet type and the interface mode. The following table summarizes the packet processing behavior for a given interface operation mode and packet type:
        
        Tunnel Decapsulation
        The firewall performs decapsulation/decryption at the parsing stage. After parsing the packet, if the firewall determines that it matches a tunnel, i.e. IPSec, SSL-VPN with SSL transport, then it performs the following sequence:
        
        The firewall decapsulates the packet first and discards it if errors exist.
        
        The tunnel interface associated with the tunnel is assigned to the packet as its new ingress interface and then the packet is fed back through the parsing process, starting with the packet header defined by the tunnel type. Currently, the supported tunnel types are IP layer tunneling, thus packet parsing (for a tunneled packet) starts with the IP header.
- - - - IP integrity Header Checking
        
        IPsec VPN Decryption
        
        Admission Control
        
        Quarantine
        
        FortiHeatBeat
        
        User Authentication
        (Captive Portal)
        
        1 more item...
        
        Admission control checks to make sure the packet is not from a source or headed to a destination on the quarantine list. If configured admission control then imposes FortiTelemetry protection that requires a device to have FortiClient installed before allowing packets from it. Admission control can also impose captive portal authentication on ingress traffic.
        
        Incoming IPsec packets that match configured IPsec tunnels on the FortiGate are decrypted after header checking is done.
        If the packet is an IPsec packet, the IPsec engine attempts to decrypt it. If the IPsec engine can apply the correct encryption keys and decrypt the packet, the unencrypted packet is sent to the next step. Non-IPsec traffic and IPsec traffic that cannot be decrypted passes on to the next step without being affected. IPsec VPN decryption is offloaded to and accelerated by CP8 or CP9 processors.
        
        IP integrity header checking reads the packet headers to verify if the packet is a valid TCP, UDP, ICMP, SCTP or GRE packet. The only verification that is done at this step to ensure that the protocol header is the correct length. If it is, the packet is allowed to carry on to the next step. If not, the packet is dropped.
      - DoS scans are handled very early in the life of the packet to determine whether the traffic is valid or is part of a DoS attack. The DoS module inspects all traffic flows but only tracks packets that can be used for DoS attacks (for example, TCP SYN packets), to ensure they are within the permitted parameters. Suspected DoS attacks are blocked, other packets are allowed.
- - - - PerVS Dow Profile including DNS and SIP
        
        DoS Device Protection including DNS and SIP
        
        HW Flow cache Lookup
        
        SW packet Processing
        
        L2 Packet Filters
        
        L2 DoS Device Protection
        
        1 more item...
        
        Success
        
        Egress
        
        When a new packet is received, the BIG-IP system performs flow lookup by querying the hardware flow table.
        When a new packet is received, the BIG-IP system performs flow lookup by querying the hardware flow table.
        
        If the BIG-IP platform uses ePVA hardware acceleration and the flow matches the hardware flow table, then the packet is passed on to flow input for post-L4 processing, in the direction of egress.
        
        If there is no match to an existing flow, the packet is processed for IP Intelligence and L2-L7 DoS protection before being passed on to TMOS flow lookup.
        
        If the HW fast-path misses, the packet is handed to TMM.
- - - - Match state ?
        
        Inspections Sec Checks
        
        NAT IP Header
        
        Egress interface
        
        L3 Route
        
        L2 Addr
        
        2 more items...
        
        On the egress interface, the interface route lookup is performed. Remember, the egress interface is determined by the translation rule that will take the priority.
        Once a Layer 3 route has been found and the next hop identified, Layer 2 resolution is performed. Layer 2 rewrite of MAC header happens at this stage.
        
        The packet is forwarded to the egress interface based on the translation rules. If no egress interface is specified in the translation rule, then the destination interface is decided based on global route lookup.
        
        IPS Module
        
        The IP header information is translated as per the NAT/PAT rule and checksums are updated accordingly. The packet is forwarded to AIP-SSM for IPS related security checks, when the AIP module is involved.
        
        The packet is subjected to an Inspection Check. This inspection verifies whether or not this specific packet flow is in compliance with the protocol. Cisco ASA has a built-in inspection engine that inspects each connection as per its pre-defined set of application-level functionalities. If it passed the inspection, it is moved forward. Otherwise, the packet is dropped and the information is logged.
        Additional Security-Checks will be implemented if a CSC module is involved.
        
        drop
        
        The packet is verified for the translation rules. If a packet passes through this check, then a connection entry is created for this flow, and the packet moves forward. Otherwise, the packet is dropped and the information is logged.
      - drop
      - The packet is processed as per the interface ACLs. It is verified in sequential order of the ACL entries and if it matches any of the ACL entries, it moves forward. Otherwise, the packet is dropped and the information is logged. The ACL hit count will be incremented by one when the packet matches the ACL entry.
- - - - Job
        
        Analysis Report
        
        Report Template
      - observables (IP addresses, hashes, email addresses, domain names, URLs…).
      - Misp
      - Cortex
  - - - TheHive’s terminology, logs are text entries which may contain attachments to help analysts record what they have been doing. Logs can be written using Markdown or a rich-text editor.
- - - - Kaspersky Security Center Database
    - - Feed Service
        
        return detections
- - - - F5asm waf
        
        Servers
    - - F5asm waf
      - Servers
- - - - internet
- - - - K Lab stats
        accum db
        
        3
        
        AutomaticAnalysisSys
        
        K Lab sigs
        db
        
        AntiVirus
        sig update
        
        4/5
        
        If the code or URL turns out to be malicious, the details are added to the Urgent Detection System database and made available to all users within minutes of the initial detection (and when the solution sends a request to KSN, it receives an immediate verdict on this threat).
        
        If the code or URL turns out to be legitimate, their records are added to the whitelisting database.
        
        If the Kaspersky Lab databases contain no corresponding records for a given sequence of indicators, the data progresses to an automated analysis system that is able to recognize most new cyberthreats. This system draws on Kaspersky Lab’s powerful human and machine resources instead of having to rely on those of user devices – with Kaspersky Lab’s experts manually analyzing the information when big data analysis cannot automatically render a verdict
- - - - Screens
        
        TCP
        
        NAT
        
        Services ALG
        
        per packer filter
        per packet shaper
        
        including all those value-added security features like UTM, IPS, anti virus and so on… These services, of course, need to work on all the packets belonging to a session
        
        meaning pure raw translations (not to identify a NAT rule to apply; that was already done during first path)
        
        to act on header and perform basic checking like sequence number check
        
        as all packets contribute to reach those volumetric thresholds we want to protect against
      - The SRX computes the session ID and realizes that session is already present in the flow table.
    - - Screens
        
        Static NAT
        
        Dest NAT
        
        Route
        
        Zones
        
        Policy
        
        2 more items...
        
        Fowarding Lookup
        
        Then, the SRX performs route lookup. This is a classical route lookup based on destination address. Lookup takes place in the routing table where the packet is at that particular moment.
        
        static NAT, if configured is applied. If not, destination NAT is performed (if configured as well). If both are configured, only static NAT (which also translates the destination address) is performed and takes precedence over destination NAT.
        
        At first, screens are applied. Screen are nothing more than an IDS (Intrusion Detection System) able to block common non-sophisticated network attacks. Screen are able to block:
        
        volumetric flooding
        
        IP options
        
        volumetric flooding
        
        IP options
      - Subsequent packets belonging to that same session will take the “fast path”. This path is shorter as, at this point, the SRX already knows a lot of things needed to properly forward packets belonging to that session
- - - - Malware analysis
        
        Updates sent to GIN
        
        Next generation
        threat prevention
        
        Real time blocking of C2 exfiltration and further infections
        
        New advanced
        threat detected
    - - Change Management System
        
        ticket info retrieved
- - - - Zeek, snort, suricata, FireEye
    - - Symantec DLP, Macfee, Secure trust
    - - Sandboxing
        
        Network Routing And Switching
        Router and Switchs
        
        SD WAN
        
        SD WAN
        
        Remote Site
        
        Wireless
        
        WAF
        
        Application Delivery / Network Load Balancing
        
        Application /
        Application Performance
        
        F5
        
        Enterprise
        users and eps management,
        network control :
        
        Endpoint
        Sec
        
        sophos
        
        DB
        Sec
        
        DDI
        DNs, DHCP, IPAM
        
        SOC
        
        SIEM
        
        Elk, Qradar
        
        Alert Forwarding
        
        1 more item...
        
        SOAR / TIP /
        Case Mgt..
        
        Cortex, theHive, Misp
        
        Code And rules Management
        
        DevOps
        
        5 more items...
        
        active directory
        
        Test MAchine
        
        Mobility Solutions
        EMM MTP
        
        NAC
        
        Cisco Identity Services Engine, FortiNAC, SafeConnect
        
        Fortisandbox, AppRun, CuckooSandbox, FireEye,
      - AT&T Global Security Gateway, Zeek umbrella, Fortinet, Fortiguard, Zscaler, CheckPoint
- - - - All password SSH keys are secured within the vault or can be extracted from third-party vaults for seamless integration.
        
        Password Manager
        
        The Password Manager is more than just a password vault. Although it securely stores and encrypts passwords, it also helps enforce robust password policies to help improve security best practices within your organization
        
        access policy
        
        extensibe session management
        
        generation complexity
        
        checkOut/checkIn Workflow
    - - SQL Plus > Databases
        
        RDP > WinServers
        
        SSH > Unix Servers
        
        SSH > Routers and Switchs
        
        Vmwqre
        
        AWS Console
- - - - SSL/TLS termination (if enabled) — decrypt so L7 inspection can see payload.