WEBVTT 1 00:00.000 --> 00:03.200 In this video I'd like to go ahead and walk you through the wonderful world 2 00:03.200 --> 00:04.400 with some demonstrations 3 00:04.400 --> 00:10.270 regarding events right here at the 40 Analyzer. So here at the 40 Analyzer is 4 00:10.270 --> 00:11.600 currently receiving 5 00:11.600 --> 00:16.840 input and logs from the branch firewall which is an HA pair. It looks like the 6 00:16.840 --> 00:18.000 HA standby is 7 00:18.000 --> 00:21.460 now running as well. Fantastic as well as the three firewalls at our 8 00:21.460 --> 00:22.480 headquarters site and 9 00:22.480 --> 00:26.750 that topology is represented right here as well. So there's firewall one, 10 00:26.750 --> 00:28.720 firewall two, firewall three 11 00:28.720 --> 00:33.140 and the branch firewall. So to see the events here at the 40 Analyzer we go to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:28.720 --> 00:33.140 and the branch firewall. So to see the events here at the 40 Analyzer we go to 12 00:33.140 --> 00:34.640 incidents and events 13 00:34.640 --> 00:38.010 and then below incident and events we just click right here on the event 14 00:38.010 --> 00:39.600 monitor. So currently 15 00:39.600 --> 00:44.400 it's pulling from all devices including the 40 Analyzer itself and also I have 16 00:44.400 --> 00:45.040 it set to show 17 00:45.040 --> 00:48.860 the last three weeks of data. And currently we have all events selected but 18 00:48.860 --> 00:50.240 there's also a tab for 19 00:50.240 --> 00:54.170 buy endpoint which actually puts a filter in then we have buy threat again 20 00:54.170 --> 00:55.440 putting a filter in for us. 21 00:56.960 --> 01:00.450 We have one for system events again putting a filter in for that and then if we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:56.960 --> 01:00.450 We have one for system events again putting a filter in for that and then if we 22 01:00.450 --> 01:00.880 don't want to 23 01:00.880 --> 01:04.130 see some of those we can go to toggle views and we can select by endpoint 24 01:04.130 --> 01:05.440 threat and system events 25 01:05.440 --> 01:09.760 what we do or don't want to see just by selecting the checkbox or putting the 26 01:09.760 --> 01:11.040 check back in to control 27 01:11.040 --> 01:14.710 what shows up. So let's go back to all events and of course like most things on 28 01:14.710 --> 01:15.920 the 40 Analyzer we 29 01:15.920 --> 01:19.510 have the gear icon here to control which columns will show up and I'm going to 30 01:19.510 --> 01:20.320 go ahead and set 31 01:20.320 --> 01:23.530 this back to the default by clicking here on reset to default and then we'll 32 01:23.530 --> 01:24.640 tweak it as we go. 33 01:24.640 --> 01:28.250 Also whether the plus symbol it implies there's more to be seen below that so 34 01:28.250 --> 01:29.280 if you want to expand 35 01:29.280 --> 01:32.650 all of it there's an option here for expand all which simply expands all the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 35 01:29.280 --> 01:32.650 all of it there's an option here for expand all which simply expands all the 36 01:32.650 --> 01:33.520 details you can also 37 01:33.520 --> 01:38.210 do a collapse all or we can expand or collapse them as desired. Also for an 38 01:38.210 --> 01:39.600 event we could go ahead 39 01:39.600 --> 01:43.790 and let me open this one up system clock adjustment. If that's not important to 40 01:43.790 --> 01:44.560 see we could also 41 01:44.560 --> 01:47.520 right click on it. For this one here we may want to say suppress if you don't 42 01:47.520 --> 01:49.120 need to see it you just 43 01:49.120 --> 01:52.870 right click say suppress event click on okay. Now we're showing that that event 44 01:52.870 --> 01:53.840 is suppressed and 45 01:53.840 --> 01:57.070 effectively what that means is identical or similar events according to the 46 01:57.070 --> 01:57.680 suppression 47 01:57.680 --> 02:00.780 details that we just set up. And that can be used as a method to help reduce WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 01:57.680 --> 02:00.780 details that we just set up. And that can be used as a method to help reduce 48 02:00.780 --> 02:01.520 alert fatigue. For 49 02:01.520 --> 02:05.450 example if thing keeps on coming up as an event and it's not a big deal by 50 02:05.450 --> 02:06.720 suppressing it we're 51 02:06.720 --> 02:10.210 then focusing more on items that need our attention. So right here we have trim 52 02:10.210 --> 02:11.360 local database if we 53 02:11.360 --> 02:15.370 right click on that once you read comments or assign it to an administrator or 54 02:15.370 --> 02:16.240 suppress it or 55 02:16.240 --> 02:19.580 we can view the logs or we can search in log v and what that'll do if we click 56 02:19.580 --> 02:20.480 on that it'll open 57 02:20.480 --> 02:25.200 up a new window for us in 40 analyzer and take us over to the log view. And so 58 02:25.200 --> 02:25.760 it actually leaves 59 02:25.760 --> 02:29.570 the original window open so we can go back to that and not lose our place. So 60 02:29.570 --> 02:30.160 behind the scenes we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 02:29.570 --> 02:30.160 behind the scenes we're 61 02:30.160 --> 02:33.750 now looking at the actual log entry behind that event. So I'm going to close 62 02:33.750 --> 02:34.560 that window and go 63 02:34.560 --> 02:38.060 back to our original window with 40 analyzer. And of course here we can also 64 02:38.060 --> 02:38.880 filter a couple 65 02:38.880 --> 02:42.620 different ways we could click up here and start selecting and typing in our 66 02:42.620 --> 02:43.680 filters or we could 67 02:43.680 --> 02:47.800 right click and then here we say I don't want to see any medium events or even 68 02:47.800 --> 02:48.880 better yet we could 69 02:48.880 --> 02:52.320 I'm going to clear that filter. One of the better application might be take the 70 02:52.320 --> 02:53.440 critical severity 71 02:53.440 --> 02:57.460 and then from the drop down here go ahead and say filter by severity equals 72 02:57.460 --> 02:58.320 critical and that 73 02:58.320 --> 03:01.890 will just show us our critical. Or another way of doing that would be you know WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 73 02:58.320 --> 03:01.890 will just show us our critical. Or another way of doing that would be you know 74 03:01.890 --> 03:03.200 start typing out here 75 03:03.200 --> 03:08.110 or severity and then we go and say equals and then three two one or zero. So we 76 03:08.110 --> 03:09.040 could select zero 77 03:09.040 --> 03:12.880 there and then click on search and that would effectively do the same thing. I 78 03:12.880 --> 03:13.920 find it a lot easier 79 03:13.920 --> 03:17.330 just to right click and do the filters that way but both options are available. 80 03:17.330 --> 03:17.680 So I'm going to 81 03:17.680 --> 03:22.170 clear the filters and now once again we're looking at all events. So with these 82 03:22.170 --> 03:23.520 tabs by end point 83 03:23.520 --> 03:27.230 that provides the security event views based on the end point perspective. So 84 03:27.230 --> 03:28.080 here's all the end 85 03:28.080 --> 03:31.690 points there. If we are looking at it by threat that's providing the event WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 03:28.080 --> 03:31.690 points there. If we are looking at it by threat that's providing the event 86 03:31.690 --> 03:32.880 views from the threat 87 03:32.880 --> 03:35.580 perspective and then what system events are showing us effectively the 88 03:35.580 --> 03:37.120 perspective from the systems. 89 03:37.120 --> 03:42.210 So log in log out failure here. What is this one? 40 analyzer. We bring it up a 90 03:42.210 --> 03:42.800 little bit. 91 03:42.800 --> 03:47.760 40 analyzer license limit exceeded. I think that's because I reboot that pretty 92 03:47.760 --> 03:48.880 frequently and it 93 03:48.880 --> 03:52.160 has the licenses and I'm not really exceeding it but it must be before I have 94 03:52.160 --> 03:52.880 full network 95 03:52.880 --> 03:56.390 connectivity and it can go out and validate its license. So that's kind of a 96 03:56.390 --> 03:57.200 nothing burger here 97 03:57.200 --> 04:00.350 in my lab environment but in a big environment where we have lots of stuff WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 03:57.200 --> 04:00.350 in my lab environment but in a big environment where we have lots of stuff 98 04:00.350 --> 04:01.600 going on we'd want to sort 99 04:01.600 --> 04:05.210 through identify what's happening and making sure that we don't have anything 100 04:05.210 --> 04:06.480 critical going on 101 04:06.480 --> 04:09.290 or at least if we do have something critical going on we want to be aware of it 102 04:09.290 --> 04:09.680 so we can 103 04:09.680 --> 04:12.970 address it and one of the first steps of doing that is right here in the event 104 04:12.970 --> 04:13.920 monitor. I'm going to 105 04:13.920 --> 04:17.300 have filter in place by right clicking on critical and then saying I want to 106 04:17.300 --> 04:18.880 sort with a filter where 107 04:18.880 --> 04:23.410 severity equals critical and then we can focus on our biggest challenges. Also 108 04:23.410 --> 04:24.080 on the left here I'm 109 04:24.080 --> 04:27.080 going to go ahead and collapse that columns we have a little more real estate 110 04:27.080 --> 04:27.920 to work with and if 111 04:27.920 --> 04:30.750 you want to put these upper tabs on the left hand side you can just use this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 111 04:27.920 --> 04:30.750 you want to put these upper tabs on the left hand side you can just use this 112 04:30.750 --> 04:31.760 icon right here and if 113 04:31.760 --> 04:35.100 you want to put them back you can just toggle horizontal menu and put them back 114 04:35.100 --> 04:35.920 . So I'm also 115 04:35.920 --> 04:39.140 going to go ahead and manage a few of my columns here as far as the first 116 04:39.140 --> 04:40.560 occurrence and last update. 117 04:40.560 --> 04:43.490 I'm going to go ahead and remove those as columns and none of these have been 118 04:43.490 --> 04:44.560 suppressed so I'm going 119 04:44.560 --> 04:47.960 to go ahead and just remove that as well and for additional info I'm going to 120 04:47.960 --> 04:49.120 remove that as well 121 04:49.120 --> 04:53.570 so that is right here I'll remove that and let's see how that looks. Actually 122 04:53.570 --> 04:54.480 this one other column 123 04:54.480 --> 04:58.640 I want to add it's not a default so I'm going to click on the gear and I want 124 04:58.640 --> 05:00.000 to add detail. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 124 04:58.640 --> 05:00.000 to add detail. So 125 05:00.000 --> 05:03.160 right here I have event details I'm going to add that as well and what that's 126 05:03.160 --> 05:03.680 going to do 127 05:03.680 --> 05:07.950 gives you a button to click on for more information so I can hover and I can 128 05:07.950 --> 05:08.880 see the detail there I 129 05:08.880 --> 05:11.610 can also click on it and it'll give me more details as well. So we have all 130 05:11.610 --> 05:12.640 that at our fingertips 131 05:12.640 --> 05:17.980 fantastic. So let's open up this one here 1030 0.103 and here we have two 132 05:17.980 --> 05:19.600 entries for compromise host 133 05:19.600 --> 05:23.730 detected and this right here is showing us the handler. So the handler is the 134 05:23.730 --> 05:24.560 set of rules like 135 05:24.560 --> 05:28.100 the security guard with a set of rules where if these things happen go ahead 136 05:28.100 --> 05:29.280 and create an event 137 05:29.280 --> 05:34.300 and so we had a handler called dark compromised host detection IOC by endpoint WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 137 05:29.280 --> 05:34.300 and so we had a handler called dark compromised host detection IOC by endpoint 138 05:34.300 --> 05:34.880 another handler 139 05:34.880 --> 05:38.750 called outbreak alert dark side ransomware detection and because these handlers 140 05:38.750 --> 05:39.760 were in place by 141 05:39.760 --> 05:43.980 default and because they recognize certain you know log messages coming in with 142 05:43.980 --> 05:44.640 the various 143 05:44.640 --> 05:48.730 indicators that's why they triggered effectively and created these events that 144 05:48.730 --> 05:49.760 we're looking at 145 05:49.760 --> 05:53.950 right here these two right here. Also the event handler applied tags to those 146 05:53.950 --> 05:54.960 events so the first 147 05:54.960 --> 05:59.170 one here was IP command and control and then for the second one here is malware 148 05:59.170 --> 05:59.760 outbreak 149 05:59.760 --> 06:03.680 CNC command and control and dark side. So each of these is a hyperlink as well WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 149 05:59.760 --> 06:03.680 CNC command and control and dark side. So each of these is a hyperlink as well 150 06:03.680 --> 06:04.640 so if we click on 151 06:04.640 --> 06:08.920 that handler it'll show us the details and effectively the rules regarding that 152 06:08.920 --> 06:09.440 handler 153 06:09.440 --> 06:13.440 why this event was created. So this is an example of a basic event handler and 154 06:13.440 --> 06:14.400 a basic event handler 155 06:14.400 --> 06:17.520 says that if any of these rules are matched then it's going to go ahead and 156 06:17.520 --> 06:18.480 create the event. It's 157 06:18.480 --> 06:23.160 also showing us based on the event that we're looking at the reason why it was 158 06:23.160 --> 06:24.240 created so there's a 159 06:24.240 --> 06:28.080 match on traffic to command and control network detected. So that's the rule 160 06:28.080 --> 06:29.120 that was matched 161 06:29.120 --> 06:32.720 and that's why this event exists because the handler rule is matched and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 161 06:29.120 --> 06:32.720 and that's why this event exists because the handler rule is matched and 162 06:32.720 --> 06:33.600 created the event. 163 06:33.600 --> 06:37.680 So we go ahead and cancel that and let's go ahead and grab the second one here 164 06:37.680 --> 06:38.720 and click on 165 06:38.720 --> 06:44.030 its handler and now it's showing us we're here in this handler why it triggered 166 06:44.030 --> 06:44.480 and created the 167 06:44.480 --> 06:48.380 event based on this rule matching right here the one in yellow. So for a basic 168 06:48.380 --> 06:49.360 handler it's an 169 06:49.360 --> 06:53.600 or condition any of the rules if they're met is going to go ahead and trigger 170 06:53.600 --> 06:54.240 and cause the event 171 06:54.240 --> 06:58.920 to be generated in 40 Analyzer and because we add the event details colony drag 172 06:58.920 --> 07:00.000 that over here for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 172 06:58.920 --> 07:00.000 that over here for 173 07:00.000 --> 07:03.860 each of those we could also click show details for more information including 174 07:03.860 --> 07:04.560 the source IP, 175 07:04.560 --> 07:08.160 source port, the threat name and more. We'll close that and we'll take a look 176 07:08.160 --> 07:08.960 at the details for the 177 07:08.960 --> 07:12.340 second one here again giving us event details so I'll close that. We can also 178 07:12.340 --> 07:13.280 right click on one of 179 07:13.280 --> 07:17.390 these events and there's two options here view logs which just simply shows us 180 07:17.390 --> 07:18.720 the logs that the 181 07:18.720 --> 07:22.920 40 Analyzer received that were part of the equation that triggered this event 182 07:22.920 --> 07:23.760 to be made and we can 183 07:23.760 --> 07:28.520 also do a search and log view. So if we click here on search and log view once 184 07:28.520 --> 07:29.360 again it opens up a 185 07:29.360 --> 07:32.610 new tab for us new window and showing us the individual log entries and then WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 185 07:29.360 --> 07:32.610 new tab for us new window and showing us the individual log entries and then 186 07:32.610 --> 07:33.280 from here we can 187 07:33.280 --> 07:36.340 right click and filter from here if we had a whole bunch or we could go ahead 188 07:36.340 --> 07:37.360 and just double click 189 07:37.360 --> 07:40.460 and that would give us the details for those individual log entries and I'm 190 07:40.460 --> 07:41.680 going to close this tab 191 07:41.680 --> 07:45.700 and go back to our original location in 40 Analyzer which is convenient because 192 07:45.700 --> 07:46.560 we don't have to you 193 07:46.560 --> 07:49.830 know find out where we were and go all the way back because this is a separate 194 07:49.830 --> 07:51.280 tab it opened for us 195 07:51.280 --> 07:54.710 and so we opened up this one this is regarding looks like some type of a SQL 196 07:54.710 --> 07:56.000 injection or attempted 197 07:56.000 --> 07:59.820 SQL injection so I'm gonna manage my columns one more time so there's a lot 198 07:59.820 --> 08:01.120 here in this is my lab WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 198 07:59.820 --> 08:01.120 here in this is my lab 199 08:01.120 --> 08:04.210 environment and I created this in a production environment we definitely want 200 08:04.210 --> 08:04.960 to investigate you 201 08:04.960 --> 08:09.330 know what's happening we have a user which is what's happening here this user 202 08:09.330 --> 08:10.560 is trying to implement 203 08:10.560 --> 08:15.270 or trying to do SQL injection attacks to some outside resource meaning some 204 08:15.270 --> 08:16.480 device on the internet 205 08:16.560 --> 08:20.220 and then this user right here is trying to send traffic to a command and 206 08:20.220 --> 08:21.440 control network very 207 08:21.440 --> 08:24.680 likely that could be malware and the list goes on now if we have an event that 208 08:24.680 --> 08:25.680 we've already dealt 209 08:25.680 --> 08:29.450 with we want not to show up here on the event list what we could do is let's go 210 08:29.450 --> 08:30.320 ahead and pick WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 210 08:29.450 --> 08:30.320 ahead and pick 211 08:30.320 --> 08:34.300 one of these let's go ahead and pick how about let me open up Linux client and 212 08:34.300 --> 08:35.360 let me right click 213 08:35.360 --> 08:38.950 on this traffic to botnet cnc dark side and what I could do is here say 214 08:38.950 --> 08:40.880 acknowledge and acknowledgement 215 08:40.880 --> 08:46.260 removes it from the event list if if click on okay if we say don't show 216 08:46.260 --> 08:48.080 acknowledge so we click here 217 08:48.080 --> 08:51.430 on show acknowledged it'll show up and if we remove the checkbox it won't show 218 08:51.430 --> 08:52.400 up that helps us to 219 08:52.400 --> 08:55.740 filter what we have to look at on this screen we could also add a column for 220 08:55.740 --> 08:56.720 acknowledged as well 221 08:56.720 --> 09:00.150 so if we click here on show acknowledged and then add a column for acknowledged WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 221 08:56.720 --> 09:00.150 so if we click here on show acknowledged and then add a column for acknowledged 222 09:00.150 --> 09:00.720 so I'll go ahead and 223 09:00.720 --> 09:04.010 do that right here there's also an option for who acknowledged it but for the 224 09:04.010 --> 09:04.640 moment I just want 225 09:04.640 --> 09:07.260 to show that it's acknowledged and showing these two right here that are now 226 09:07.260 --> 09:08.080 acknowledged so if we 227 09:08.080 --> 09:11.710 want to hide those we simply say don't show acknowledged and that is removed 228 09:11.710 --> 09:13.040 now from our screen if we 229 09:13.040 --> 09:16.880 have an administrator for example who's in charge of firewall three we could 230 09:16.880 --> 09:18.080 take these events and 231 09:18.080 --> 09:22.920 assign them to the firewall three administrator so let me open up the left 232 09:22.920 --> 09:24.160 panel here i'll go to 233 09:24.160 --> 09:28.750 system settings administrators so we have a branch admin but it's only in 234 09:28.750 --> 09:29.600 charge of the 235 09:29.600 --> 09:32.870 b-r-1-8 on which has no 40 gates in it so let's go ahead and create a new WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 235 09:29.600 --> 09:32.870 b-r-1-8 on which has no 40 gates in it so let's go ahead and create a new 236 09:32.870 --> 09:34.320 administrator firewall three 237 09:35.840 --> 09:41.020 admin i'll add a photo we'll go ahead and drag and drop a photo there fantastic 238 09:41.020 --> 09:42.080 it's uploading 239 09:42.080 --> 09:46.480 click on okay so there's the image and as far as this administrator we'll give 240 09:46.480 --> 09:47.520 them a password 241 09:47.520 --> 09:51.060 we'll choose a profile and ideally we may want to have firewall three in its 242 09:51.060 --> 09:51.120 own 243 09:51.120 --> 09:54.740 administrative domain but for now let's be fine we'll click on okay so now we 244 09:54.740 --> 09:55.040 have that 245 09:55.040 --> 09:58.770 administrator we'll go back to incidents and events under event monitor and I 246 09:58.770 --> 09:59.280 forget which 247 09:59.280 --> 10:01.740 one we were looking at but let's just imagine this system right here we can WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 247 09:59.280 --> 10:01.740 one we were looking at but let's just imagine this system right here we can 248 10:01.740 --> 10:02.720 right click on it 249 10:02.720 --> 10:07.120 and assign two and then go ahead and assign it to firewall three admin and then 250 10:07.120 --> 10:08.080 click on okay and 251 10:08.080 --> 10:11.520 if you want to add a column for assigned we could so let's go ahead and do that 252 10:11.520 --> 10:12.080 we'll click on the 253 10:12.080 --> 10:16.050 gear and here's a column for assigned two we'll add that fantastic and that 254 10:16.050 --> 10:16.960 shows up right here as 255 10:16.960 --> 10:20.100 well and what we can do for firewall three or they can do it as well with the 256 10:20.100 --> 10:21.280 permissions is we can 257 10:21.280 --> 10:25.310 right click there and say search and then look for a filter saying exactly 258 10:25.310 --> 10:27.040 assigned to firewall three 259 10:27.040 --> 10:30.970 and then we could go ahead and save that as a custom view so let's go ahead and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 259 10:27.040 --> 10:30.970 and then we could go ahead and save that as a custom view so let's go ahead and 260 10:30.970 --> 10:31.600 do that we'll click 261 10:31.600 --> 10:36.500 right here on create custom view we'll call this assigned to fw3 admin and then 262 10:36.500 --> 10:38.320 click on okay so now 263 10:38.320 --> 10:42.280 well if we're looking at instant events here in the event monitor we can go to 264 10:42.280 --> 10:44.160 the custom view and 265 10:44.160 --> 10:47.010 here that view is ready to go and if we had multiple custom views usually the 266 10:47.010 --> 10:47.920 drop down right here 267 10:47.920 --> 10:50.470 to go ahead and select the custom view that you want to see for example let's 268 10:50.470 --> 10:51.600 create one more 269 10:51.600 --> 10:55.050 so go back to all events i'll clear the existing filter and let's make one 270 10:55.050 --> 10:56.320 looking just for critical 271 10:56.320 --> 11:00.020 so i'll right click and say filter by severity equals critical and i'll save WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 271 10:56.320 --> 11:00.020 so i'll right click and say filter by severity equals critical and i'll save 272 11:00.020 --> 11:00.880 that as a custom 273 11:00.880 --> 11:06.160 view as well so create custom view and click on okay and now under custom view 274 11:06.160 --> 11:06.800 we have our two 275 11:06.800 --> 11:10.510 custom views we have assigned to firewall three admin from the drop down and 276 11:10.510 --> 11:10.880 then we have the 277 11:10.880 --> 11:13.840 other one we just made we just call it critical and that can be really handy 278 11:13.840 --> 11:15.040 for any views that use a 279 11:15.040 --> 11:19.010 lot and don't want to have to recreate with filters every single time just 280 11:19.010 --> 11:20.000 create them as part of a 281 11:20.000 --> 11:24.300 custom view also remember if you go back to all events your last filter you 282 11:24.300 --> 11:25.440 have in place is still 283 11:25.440 --> 11:28.560 there so just be aware if you don't want to look at that or don't want that 284 11:28.560 --> 11:29.760 filter click on the x 285 11:29.760 --> 11:34.100 here to remove any existing filters so once again by creating our custom views WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 285 11:29.760 --> 11:34.100 here to remove any existing filters so once again by creating our custom views 286 11:34.100 --> 11:34.640 we could 287 11:34.640 --> 11:38.080 easily go back and forth with any views that we want to see the events that we 288 11:38.080 --> 11:38.720 want based on the 289 11:38.720 --> 11:42.620 filters now another element i want to share with you regarding events let me go 290 11:42.620 --> 11:43.360 ahead and clear the 291 11:43.360 --> 11:47.340 filters here you know in fact let's go back to custom view just tab here and 292 11:47.340 --> 11:49.360 let's take a look at our 293 11:49.360 --> 11:55.050 critical events fantastic here they are now currently all of these events are 294 11:55.050 --> 11:56.000 unhandled now 295 11:56.000 --> 11:59.640 what exactly does that mean effectively what it means is that this security 296 11:59.640 --> 12:01.120 event these critical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 296 11:59.640 --> 12:01.120 event these critical 297 12:01.120 --> 12:04.710 severity security events that we're looking at are open they haven't been 298 12:04.710 --> 12:06.080 addressed yet so here in 299 12:06.080 --> 12:10.910 the event status for all of these critical events there are four options one is 300 12:10.910 --> 12:11.840 blank where it says 301 12:11.840 --> 12:15.730 nothing there's an option called unhandled which we see here there's an option 302 12:15.730 --> 12:17.040 called contained and 303 12:17.040 --> 12:21.010 there's another option called mitigated so if we remove this filter when we 304 12:21.010 --> 12:21.920 look at everything 305 12:21.920 --> 12:25.350 you'll notice that we have a whole bunch that are unhandled we have some that 306 12:25.350 --> 12:26.320 are mitigated and 307 12:26.320 --> 12:30.050 some are blank and because i don't have it set up on my forte gates i don't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 307 12:26.320 --> 12:30.050 some are blank and because i don't have it set up on my forte gates i don't 308 12:30.050 --> 12:31.280 have any yet that are 309 12:31.280 --> 12:35.670 set up as contained so here's what it means unhandled means it hasn't been 310 12:35.670 --> 12:37.040 addressed yet it hasn't 311 12:37.040 --> 12:40.790 been mitigated or contained so it's considered effectively open if it's that 312 12:40.790 --> 12:41.840 contained it would 313 12:41.840 --> 12:45.500 mean that the risk is isolated for example if we had a quarantine action and we 314 12:45.500 --> 12:46.480 've quarantined 315 12:46.480 --> 12:51.020 that device that would show as a result here of contained if the firewall 316 12:51.020 --> 12:52.080 blocked it or dropped 317 12:52.080 --> 12:55.640 the traffic that would be showed up as mitigated which we see right here for 318 12:55.640 --> 12:56.720 the antivirus where 319 12:56.720 --> 13:00.170 the firewall dropped it we can also verify that by double clicking here so here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 319 12:56.720 --> 13:00.170 the firewall dropped it we can also verify that by double clicking here so here 320 13:00.170 --> 13:00.720 's the log we'll 321 13:00.720 --> 13:04.220 double click here and it's going to show us that indeed it was blocked and that 322 13:04.220 --> 13:04.960 's what showing here 323 13:04.960 --> 13:09.300 in the event status the status of mitigated where if we go to the web request 324 13:09.300 --> 13:10.560 for malicious website 325 13:10.560 --> 13:13.910 and double click there and then look at the log the action was passed through 326 13:13.910 --> 13:14.960 it didn't stop it 327 13:14.960 --> 13:19.560 and that's because of a security profile that was configured in this case on 328 13:19.560 --> 13:20.320 purpose so i could 329 13:20.320 --> 13:23.390 demonstrate about allowing some traffic through that probably shouldn't have 330 13:23.390 --> 13:24.240 been allowed but it was 331 13:24.240 --> 13:27.770 based on the profile and the action here was passed through and again that's 332 13:27.770 --> 13:29.040 why it's showing up here 333 13:29.040 --> 13:33.200 as an event status of unhandled and then for the ones where it's blank here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 333 13:29.040 --> 13:33.200 as an event status of unhandled and then for the ones where it's blank here 334 13:33.200 --> 13:33.920 that's for other 335 13:33.920 --> 13:37.660 scenarios so the three we need to be aware of are unhandled meaning we probably 336 13:37.660 --> 13:38.640 had to take a closer 337 13:38.640 --> 13:42.380 look at that mitigated which means hey we want to be aware of it but you know 338 13:42.380 --> 13:43.360 on its own that the 339 13:43.360 --> 13:47.950 attack wasn't successful and contained also implies that the trouble device or 340 13:47.950 --> 13:49.280 that trouble system 341 13:49.280 --> 13:52.800 has been quarantined and depending on the version of 40 allies you're running 342 13:52.800 --> 13:54.640 uh these options 343 13:54.640 --> 13:58.360 regarding looking at the actual events maybe in a different location but 344 13:58.360 --> 13:59.920 hopefully very findable 345 13:59.920 --> 14:03.700 so again this is the latest and greatest feature version as of this recording WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 345 13:59.920 --> 14:03.700 so again this is the latest and greatest feature version as of this recording 346 14:03.700 --> 14:06.240 this is version 7.63