WEBVTT

1
00:00.000 --> 00:03.350
In this video, we get to take a big picture look at the wonderful world of

2
00:03.350 --> 00:06.000
events inside of the 40 Analyzer.

3
00:06.000 --> 00:10.160
And to start off, I'd like to chat about on the 40 Analyzer what an event is

4
00:10.160 --> 00:10.400
not.

5
00:10.400 --> 00:15.840
Because it's sometimes confusing when the same word is used and not in the

6
00:15.840 --> 00:16.640
right context or we're

7
00:16.640 --> 00:20.460
not aware of the context and it means something different. So as far as a 48

8
00:20.460 --> 00:21.360
firewall, we're looking

9
00:21.360 --> 00:25.360
right here at firewall one and I've gone down here under log and reports to

10
00:25.360 --> 00:26.480
security events.

11
00:26.480 --> 00:31.370
And then I've clicked on logs here. So the raw log events here on this 48, if
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.480 --> 00:31.370
And then I've clicked on logs here. So the raw log events here on this 48, if

12
00:31.370 --> 00:32.320
we go to the category,

13
00:32.320 --> 00:37.290
for example, we have antivirus, web filter, DNS queries, etc, etc, etc. And

14
00:37.290 --> 00:38.000
currently I have web

15
00:38.000 --> 00:41.780
filter selected. I'm currently looking at the local memories here on this 48.

16
00:41.780 --> 00:42.800
Now this 48 has

17
00:42.800 --> 00:46.380
been sending all of its log information over to the 40 Analyzer. So we think of

18
00:46.380 --> 00:47.360
events on the local

19
00:47.360 --> 00:51.290
48 firewall, if you go in as the local events that are happening, but these are

20
00:51.290 --> 00:52.240
just the event

21
00:52.240 --> 00:56.240
logs here that we're looking at that are being sent over to the 40 Analyzer.

22
00:56.240 --> 00:57.520
Because over on the 40

23
00:57.520 --> 01:02.090
Analyzer, an event means something a little bit different. So here on the 40
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.520 --> 01:02.090
Analyzer, an event means something a little bit different. So here on the 40

24
01:02.090 --> 01:03.280
Analyzer, and under

25
01:03.280 --> 01:07.530
instance events, we go down here to event monitor, this is showing us a list of

26
01:07.530 --> 01:08.400
events. And that's

27
01:08.400 --> 01:11.990
for the last 30 minutes, so we go and change that to last, let's say three

28
01:11.990 --> 01:13.280
weeks. And this from a

29
01:13.280 --> 01:18.070
40 Analyzer perspective, under the instance events here is a representation of

30
01:18.070 --> 01:19.520
events as shown here

31
01:19.520 --> 01:23.400
at the 40 Analyzer. So where's the biggest difference between the word event at

32
01:23.400 --> 01:24.560
the 48 itself with

33
01:24.560 --> 01:28.470
this logs, and then an event over here at the 40 Analyzer. And so to help

34
01:28.470 --> 01:29.520
really understand this,

35
01:29.520 --> 01:32.230
let's go ahead and just imagine the workflow here. So let's imagine we have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:29.520 --> 01:32.230
let's go ahead and just imagine the workflow here. So let's imagine we have

36
01:32.230 --> 01:33.520
some logging messages,

37
01:33.520 --> 01:37.360
they could be event messages from the security events happening on the firewall

38
01:37.360 --> 01:38.000
. And those are

39
01:38.000 --> 01:42.300
all being sent over to the 40 Analyzer, along with traffic logs and security

40
01:42.300 --> 01:43.280
logs and so forth.

41
01:43.280 --> 01:47.050
And so those logs are being sent over include traffic logs, event logs, and

42
01:47.050 --> 01:47.920
security logs.

43
01:47.920 --> 01:52.640
However, once those get over to the 40 Analyzer, they're kept in a log format

44
01:52.640 --> 01:53.360
initially,

45
01:53.360 --> 01:56.120
and then they're put into the SQL database, we've taken a look at that in

46
01:56.120 --> 01:57.520
previous sets of videos.

47
01:57.520 --> 02:01.820
And then what happens in the brains in the back end of the 40 Analyzer is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.520 --> 02:01.820
And then what happens in the brains in the back end of the 40 Analyzer is

48
02:01.820 --> 02:03.200
taking all that information

49
02:03.200 --> 02:06.900
that's received, all that logging information from all the devices are sending

50
02:06.900 --> 02:07.760
in logs to the 40

51
02:07.760 --> 02:11.990
Analyzer. And it's using something called an event handler. And one more thing

52
02:11.990 --> 02:12.800
about an event

53
02:12.800 --> 02:16.870
handler over here at the 40 Analyzer is think of it like the analogy of a

54
02:16.870 --> 02:18.080
security guard who's

55
02:18.080 --> 02:21.540
looking at all the mail and packages that come into a building. So if a

56
02:21.540 --> 02:22.640
security guard is in the

57
02:22.640 --> 02:26.160
mail room, for example, looking at all the incoming parcels and packages and

58
02:26.160 --> 02:26.720
letters,

59
02:26.720 --> 02:31.030
there's lots of different sizes and different people they're addressed to. And
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:26.720 --> 02:31.030
there's lots of different sizes and different people they're addressed to. And

60
02:31.030 --> 02:31.440
the security

61
02:31.440 --> 02:34.580
guard has a set of rules. And in this analogy, one of the rules that the

62
02:34.580 --> 02:35.920
security guard may have is

63
02:35.920 --> 02:41.520
that if there are three letters from the same sender within five minutes, send

64
02:41.520 --> 02:42.640
an alert, or if a

65
02:42.640 --> 02:46.460
package arrives, it doesn't have a return address, or it's an oversized package

66
02:46.460 --> 02:47.600
, it seems kind of heavy,

67
02:47.600 --> 02:50.800
maybe a razor red flag and send an alert saying, Hey, you know what, there's a

68
02:50.800 --> 02:51.600
possible problem

69
02:51.600 --> 02:54.880
with this, it could be an issue. And so the security guard is then taking

70
02:54.880 --> 02:56.240
action of some type based

71
02:56.240 --> 02:59.520
on a set of rules. Well, that's very similar to what an event handler does

72
02:59.520 --> 03:00.800
inside of a 40 Analyzer,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.520 --> 03:00.800
inside of a 40 Analyzer,

73
03:00.800 --> 03:04.860
based on the log messages that are coming in to the 40 Analyzer. So on the 40

74
03:04.860 --> 03:05.840
Analyzer example,

75
03:05.840 --> 03:09.500
could be we can have an event handler that's looking for five failed login

76
03:09.500 --> 03:10.720
attempts within one

77
03:10.720 --> 03:14.260
minute, and that raising the red flag, the result of that, if that was the rule

78
03:14.260 --> 03:15.040
, that raising the

79
03:15.040 --> 03:19.090
red flag is in the form of creating an event. And because the 40 Analyzer is

80
03:19.090 --> 03:20.240
receiving logs from

81
03:20.240 --> 03:24.220
all types of different devices, also it has its own logs for, you know, login

82
03:24.220 --> 03:25.280
attempts locally as

83
03:25.280 --> 03:29.240
well, those rules could be set up for failed login attempts to any of our 40

84
03:29.240 --> 03:30.000
gates that are being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.240 --> 03:30.000
gates that are being

85
03:30.000 --> 03:33.830
managed, or it could be rules regarding failed login attempts at the 40 Analy

86
03:33.830 --> 03:34.800
zer itself. Here's

87
03:34.800 --> 03:38.460
another example of a rule, let's imagine that with all the logs being sent in,

88
03:38.460 --> 03:39.600
the firewalls identify

89
03:39.600 --> 03:43.880
that this PC right here is reaching out to a command and control network we're

90
03:43.880 --> 03:45.040
attempting to,

91
03:45.040 --> 03:48.410
as well as attempting to do it to other malicious websites. So those can be

92
03:48.410 --> 03:49.440
correlated based on

93
03:49.440 --> 03:52.840
the event handler rules, and as a result, it could once again create an event.

94
03:52.840 --> 03:53.520
So when we think of

95
03:53.520 --> 03:57.600
events over at the 40 Analyzer, think of it as a set of rules that were matched

96
03:57.600 --> 03:58.960
by an event handler

97
03:58.960 --> 04:03.160
that created an event to allow us to know that that event occurred. And then
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:58.960 --> 04:03.160
that created an event to allow us to know that that event occurred. And then

98
04:03.160 --> 04:03.920
there's actually one

99
04:03.920 --> 04:08.480
step further as well, we can also based on that event being created, we can

100
04:08.480 --> 04:09.360
also have the event

101
04:09.360 --> 04:13.760
handler actually create a new incident as well. And we'll have a separate skill

102
04:13.760 --> 04:14.480
regarding instance,

103
04:14.480 --> 04:19.230
but for now just realized that an instant thing like a case file or a ticket

104
04:19.230 --> 04:20.240
that we can use then

105
04:20.240 --> 04:25.980
to further analyze and work on a potential compromise or network. So a ticket

106
04:25.980 --> 04:27.040
could include

107
04:27.040 --> 04:30.940
multiple events as a collection for further analysis, and we'll have a whole
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:27.040 --> 04:30.940
multiple events as a collection for further analysis, and we'll have a whole

108
04:30.940 --> 04:31.840
separate skill

109
04:31.840 --> 04:35.330
on creating and working with instance. But for now, I just want to be aware of

110
04:35.330 --> 04:36.400
the workflow where

111
04:36.400 --> 04:40.570
logs bring sent to 40 Analyzer, they're inserted into the SQL database, an

112
04:40.570 --> 04:41.920
event handler looking at

113
04:41.920 --> 04:45.980
all those log messages with a set of rules, we then go ahead and create events.

114
04:45.980 --> 04:46.720
And then further,

115
04:46.720 --> 04:50.320
we can take those events, create incidents for further analysis and

116
04:50.320 --> 04:52.080
investigation and tracking

117
04:52.080 --> 04:55.710
of potential problems in our network. But for now, we're going to focus on the

118
04:55.710 --> 04:56.240
creation and

119
04:56.240 --> 05:02.400
working with events and the event handlers, which make that all possible.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:56.240 --> 05:02.400
working with events and the event handlers, which make that all possible.