WEBVTT 1 00:00.000 --> 00:03.840 In this video, I'd like to walk you through some cases where we might need to 2 00:03.840 --> 00:04.720 create a custom 3 00:04.720 --> 00:09.410 event handler, either a basic one, where that event handler based on any of the 4 00:09.410 --> 00:10.400 rules in it 5 00:10.400 --> 00:14.800 would trigger and create an event or a correlation event handler. Again, the 6 00:14.800 --> 00:15.840 difference is the 7 00:15.840 --> 00:20.320 basic is any rule that matches is going to trigger where a correlation, all the 8 00:20.320 --> 00:20.960 events that are 9 00:20.960 --> 00:24.060 specified in that correlation event handler have to happen within the 10 00:24.060 --> 00:25.440 parameters are specified as 11 00:25.440 --> 00:28.590 part of that handler. And actually, now I think about it, I also want to take a 12 00:28.590 --> 00:29.440 moment and maybe 13 00:29.440 --> 00:33.660 just demonstrate how a correlation event handler is functioning based on a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:29.440 --> 00:33.660 just demonstrate how a correlation event handler is functioning based on a 14 00:33.660 --> 00:34.960 series of events. And 15 00:34.960 --> 00:38.330 then after I do a quick demo, we'll get into the creating and using a custom 16 00:38.330 --> 00:39.360 event handler. So 17 00:39.360 --> 00:42.910 here in the 40 end laser, as a demo of a correlation event handler, we'll go to 18 00:42.910 --> 00:43.920 incident events and 19 00:43.920 --> 00:47.650 go to event handlers. And let me make sure we're looking at all of them. So 20 00:47.650 --> 00:48.480 currently, if we go to 21 00:48.480 --> 00:52.200 more and show custom, I have no custom ones. So let's take a look at all of 22 00:52.200 --> 00:53.200 them. Fantastic. 23 00:53.200 --> 00:57.100 And let's scroll down. And here's the great one right here. So the icon 24 00:57.100 --> 00:58.240 indicates it's a correlation 25 00:58.240 --> 01:03.650 event handler. And it's for brute force account logins against the 40 gate. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 25 00:58.240 --> 01:03.650 event handler. And it's for brute force account logins against the 40 gate. So 26 01:03.650 --> 01:04.800 based on the rule 27 01:04.800 --> 01:08.640 here, let me just open it up says this handler is to detect if an account login 28 01:08.640 --> 01:09.680 failed many times, 29 01:09.680 --> 01:14.880 not followed by a login success for 40 gate. And if we scroll down here, 30 01:14.880 --> 01:16.080 showing the correlation 31 01:16.080 --> 01:21.150 sequence, so it's login failed five times, not followed by a successful login. 32 01:21.150 --> 01:22.000 So that's the 33 01:22.000 --> 01:26.260 correlation. So to trigger this, what we could do is log in, you know, five 34 01:26.260 --> 01:27.360 times or fail to log 35 01:27.360 --> 01:32.040 on a 40, five times, and then not log in for five minutes successfully. And WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 35 01:27.360 --> 01:32.040 on a 40, five times, and then not log in for five minutes successfully. And 36 01:32.040 --> 01:33.520 that should trigger it. 37 01:33.520 --> 01:37.720 Now, unfortunately, on a 40 gate firewall, the default server in place will 38 01:37.720 --> 01:38.720 only let you log in 39 01:38.720 --> 01:42.780 three times. And then it gives you a five minute timeout. So let's, let's set 40 01:42.780 --> 01:43.680 ourselves up for 41 01:43.680 --> 01:48.400 success in demonstrating this correlation event handler. So to do that, let's 42 01:48.400 --> 01:49.440 go over to firewall 43 01:50.400 --> 01:55.230 two. So here's firewall to a login, I'm going to log in successfully, because I 44 01:55.230 --> 01:55.680 need to change 45 01:55.680 --> 01:59.840 a few parameters first. And here on firewall to let me go ahead and click on 46 01:59.840 --> 02:00.640 the icon for a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 01:59.840 --> 02:00.640 the icon for a 47 02:00.640 --> 02:06.500 command line interface, and let's do a config system global and let's do a show 48 02:06.500 --> 02:07.600 full configuration 49 02:07.600 --> 02:12.180 and hit space bar. And there are a lot of options here. So let's do this look 50 02:12.180 --> 02:13.760 for the set admin, 51 02:13.760 --> 02:18.160 oh, which is right here near the top. So here's the set admin lockout threshold 52 02:18.160 --> 02:18.960 of three. So basically, 53 02:19.680 --> 02:24.830 three failed attempts is going to lock me out for, I think that's 60 seconds. 54 02:24.830 --> 02:25.040 Now, 55 02:25.040 --> 02:28.640 I don't think that's the default I may have changed that. I thought the default 56 02:28.640 --> 02:29.120 was five 57 02:29.120 --> 02:33.680 minutes in any event. Currently, we'll never get to five failed login attempts, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 02:29.120 --> 02:33.680 minutes in any event. Currently, we'll never get to five failed login attempts, 58 02:33.680 --> 02:34.160 if it's going to 59 02:34.160 --> 02:36.910 lock us out of three and make us wait, or I guess we could, but instead of 60 02:36.910 --> 02:37.840 doing that, let's just 61 02:37.840 --> 02:42.150 change the lockout threshold to something higher. So I'm going to go ahead and 62 02:42.150 --> 02:43.280 copy this first part 63 02:43.280 --> 02:47.620 here, right click copy, then we'll paste that in. And I'm going to go ahead and 64 02:47.620 --> 02:48.960 set it to 10, 65 02:48.960 --> 02:52.840 press center. And that way, I don't have to wait here at the local 40 gate to 66 02:52.840 --> 02:53.600 do more than five 67 02:53.600 --> 02:57.010 failed login attempts. So go ahead and type in and there we'll close that. And 68 02:57.010 --> 02:57.920 then what we'll do 69 02:57.920 --> 03:02.320 is we'll click on admin and we'll log out and then I'll log in as admin. In WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 69 02:57.920 --> 03:02.320 is we'll click on admin and we'll log out and then I'll log in as admin. In 70 03:02.320 --> 03:03.200 fact, let me use a 71 03:03.200 --> 03:08.250 different username as well as couldn't do bogus and a bad password. And let me 72 03:08.250 --> 03:10.160 try bogus, another 73 03:10.160 --> 03:14.540 bad password and bogus and bogus and another bad password. In fact, you know 74 03:14.540 --> 03:15.760 what, that doesn't 75 03:15.760 --> 03:20.340 mean a valid username. Let me try admin. Keith, don't think too much on the fly 76 03:20.340 --> 03:21.360 . Anyway, I'm going to 77 03:21.360 --> 03:25.050 do admin just to make sure that we're looking for the admin account there who 78 03:25.050 --> 03:25.840 does exist in the 79 03:25.840 --> 03:29.760 system and bad password. Oh, yeah, see, it's trying. There we go. Yeah, I think 80 03:29.760 --> 03:30.800 I need to do admin WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 03:29.760 --> 03:30.800 I need to do admin 81 03:30.800 --> 03:34.220 account five times for a valid user account because it's thinking about it 82 03:34.220 --> 03:35.200 failing because the admin 83 03:35.200 --> 03:39.660 accounts valid, but the password isn't I think that's three times and now four 84 03:39.660 --> 03:41.360 times and five times. 85 03:41.360 --> 03:44.520 And I'm going to do one more just in case I got the count from and hopefully it 86 03:44.520 --> 03:45.280 's under 10 87 03:45.280 --> 03:48.760 because I also want to be able to re log in. So in the correlation event 88 03:48.760 --> 03:49.760 handler, he was looking 89 03:49.760 --> 03:54.580 for five login attempts that failed, not followed by a successful login for 90 03:54.580 --> 03:56.000 five minutes. So what 91 03:56.000 --> 04:00.310 I'm going to do here is I am not going to log on to what is this firewall to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 03:56.000 --> 04:00.310 I'm going to do here is I am not going to log on to what is this firewall to 92 04:00.310 --> 04:01.200 and we're going to go 93 04:01.200 --> 04:05.700 back to 40 analyzer and wait a little bit. So we'll go back to event monitor 94 04:05.700 --> 04:07.120 and I'm looking at all 95 04:07.120 --> 04:11.660 events for the last five minutes. Fantastic. So there's nothing showing up 96 04:11.660 --> 04:12.960 right here, but once 97 04:12.960 --> 04:16.760 it hits, it should show up if we do a refresh. So I'm going to pause the 98 04:16.760 --> 04:18.080 recording here for a bit. 99 04:18.080 --> 04:22.720 And then once it shows up, I'll resume the recording. So due to the magic of 100 04:22.720 --> 04:23.120 editing and 101 04:23.120 --> 04:26.250 pausing the recording, we aren't going to have to wait five minutes. And 102 04:26.250 --> 04:26.800 actually, you know what, 103 04:26.800 --> 04:30.300 while we're waiting, we could actually take advantage of our time by going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 04:26.800 --> 04:30.300 while we're waiting, we could actually take advantage of our time by going to 104 04:30.300 --> 04:31.440 event handlers and I can 105 04:31.440 --> 04:35.040 walk you through how to create a custom one. So to create a custom event 106 04:35.040 --> 04:36.400 handler, you simply click 107 04:36.400 --> 04:40.600 on create new and then put in all the details. Now, because there are so many 108 04:40.600 --> 04:41.120 possible, you know, 109 04:41.120 --> 04:45.520 options and details, what we might want to do is take an event handler that's 110 04:45.520 --> 04:46.960 close to what we need 111 04:46.960 --> 04:51.440 and clone it and then tweak it. So for example, here's the default botnet 112 04:51.440 --> 04:55.140 communication detection event handler. So if we right clicked on that one and 113 04:55.140 --> 04:56.320 clicked on clone, 114 04:56.320 --> 05:01.240 we go ahead and start there. So we'll call it our botnet detection handler, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 114 04:56.320 --> 05:01.240 we go ahead and start there. So we'll call it our botnet detection handler, 115 05:01.240 --> 05:02.400 just like that. 116 05:02.400 --> 05:05.040 And we'll leave most of the details in place. But you know what, we could also 117 05:05.040 --> 05:10.040 remove or disable some of these rules because we don't really need to match on, 118 05:10.040 --> 05:10.240 you know, 119 05:10.240 --> 05:14.450 the one we're going to test. So as a demonstration, let me disable all of them, 120 05:14.450 --> 05:15.120 except for this one 121 05:15.120 --> 05:17.960 right there, that we can do the same test we did before. And if you wanted to 122 05:17.960 --> 05:18.640 delete some of these, 123 05:18.640 --> 05:22.240 we could just put them in the trash can by removing them, either way is great. 124 05:22.240 --> 05:22.640 So we effectively 125 05:22.640 --> 05:26.040 have this one rule. There's also an option for notification profiles. If you 126 05:26.040 --> 05:26.880 create notification 127 05:26.880 --> 05:32.020 profiles, for example, sending to email or syslog or other notification options WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 05:26.880 --> 05:32.020 profiles, for example, sending to email or syslog or other notification options 128 05:32.020 --> 05:32.640 , you can then 129 05:32.640 --> 05:36.950 select the notification profile. And when this hits, when this event handler 130 05:36.950 --> 05:37.760 hits and has its 131 05:37.760 --> 05:41.790 matches, in addition to creating the event, it would also go ahead and act on 132 05:41.790 --> 05:43.040 whatever notifications 133 05:43.040 --> 05:46.340 we had set up. So for now, I'm going to click on, okay, so now we have a custom 134 05:46.340 --> 05:46.960 one, I'm also 135 05:46.960 --> 05:50.720 going to go ahead and right click on this one. And I'm going to disable it. So 136 05:50.720 --> 05:51.600 this one from the 137 05:51.600 --> 05:55.080 factory now is going to be disabled. So if I sort by status here, the one right 138 05:55.080 --> 05:55.840 here is now 139 05:55.840 --> 05:59.590 disabled shown by this icon. However, if we get a more and we say, please don't 140 05:59.590 --> 06:00.400 show a predefined, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 05:59.590 --> 06:00.400 show a predefined, 141 06:00.400 --> 06:05.570 just custom hour one that when we made is still enabled. So let's test it out 142 06:05.570 --> 06:06.880 and verify that it's 143 06:06.880 --> 06:10.120 going to go ahead and create an event for us. So to try that, let's go back to 144 06:10.120 --> 06:10.800 our client, 145 06:10.800 --> 06:14.790 we'll go to PC to, and we'll hit the upper key and do a name resolution for 146 06:14.790 --> 06:16.000 combat shell. 147 06:16.000 --> 06:21.630 Another one for office RSVP. Now that's done, let me go ahead and minimize that 148 06:21.630 --> 06:22.320 . And in a little 149 06:22.320 --> 06:24.800 bit, if it creates the events for us, we should see the event show up right 150 06:24.800 --> 06:26.240 there. Or we could just 151 06:26.240 --> 06:31.210 go to events. And there's our default brute force account login attack that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 151 06:26.240 --> 06:31.210 go to events. And there's our default brute force account login attack that 152 06:31.210 --> 06:32.640 triggered fantastic. 153 06:32.640 --> 06:37.280 That's there. And also, if we click on refresh here, we should have our DNS. 154 06:37.280 --> 06:38.800 And that was matched on 155 06:38.800 --> 06:42.880 by our handler called our botnet detection handler. And that's why we're seeing 156 06:42.880 --> 06:43.680 this event 157 06:43.680 --> 06:47.600 right here is based on our botnet detection handler. Also, I don't want to 158 06:47.600 --> 06:48.160 leave that other 159 06:48.160 --> 06:52.100 one disabled. So I'm going to go ahead back to event handlers, I'll sort by 160 06:52.100 --> 06:53.200 status, we'll scroll 161 06:53.200 --> 06:57.270 down, and that's going to be the search for botnet and then sort by status. And 162 06:57.270 --> 06:57.680 this is the one right 163 06:57.680 --> 07:01.330 there that we disabled. So I'm going to go ahead and I'm going to enable it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 163 06:57.680 --> 07:01.330 there that we disabled. So I'm going to go ahead and I'm going to enable it. 164 07:01.330 --> 07:01.920 And also I'm going to 165 07:01.920 --> 07:06.020 right click, and I'm going to say factory reset and click on okay. And because 166 07:06.020 --> 07:06.880 we don't need to, 167 07:06.880 --> 07:11.520 I'm also going to go to more and show custom only. And right click on this one 168 07:11.520 --> 07:11.920 that we aren't 169 07:11.920 --> 07:14.850 going to need anymore because we have the default one in place. And I'm going 170 07:14.850 --> 07:16.000 to go ahead and delete 171 07:16.000 --> 07:20.910 it and say goodbye with an okay and audio some me go. And then we have our pred 172 07:20.910 --> 07:21.920 efined botnet 173 07:21.920 --> 07:25.700 communication detection in place. It's enabled. I'll sit back to the default. 174 07:25.700 --> 07:26.320 And just to confirm 175 07:26.320 --> 07:29.790 all the rules are enabled and it's ready to go. So we'll click on okay. And 176 07:29.790 --> 07:30.640 just as a quick test, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 176 07:29.790 --> 07:30.640 just as a quick test, 177 07:30.640 --> 07:35.060 let's go back to our client and do a couple more name resolutions. And we'll 178 07:35.060 --> 07:36.080 minimize that. And 179 07:36.080 --> 07:39.490 then the new events that come in that are indicating that our client was trying 180 07:39.490 --> 07:40.560 to do name resolution 181 07:40.560 --> 07:43.960 of some command and control domains. Those should show up now, but they should 182 07:43.960 --> 07:44.880 show up as having 183 07:44.880 --> 07:49.190 been caused by this default botnet communication detection event handler. So we 184 07:49.190 --> 07:49.920 'll go back to event 185 07:49.920 --> 07:53.440 monitor looking at the last five minutes, and we'll expand our Linux client 186 07:53.440 --> 07:54.480 here. And sure enough, 187 07:54.480 --> 07:58.980 we had one that was identified by our botnet detection handler. And then going 188 07:58.980 --> 07:59.520 forward, 189 07:59.520 --> 08:03.170 it was using the default botnet communication detection, because we deleted our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 189 07:59.520 --> 08:03.170 it was using the default botnet communication detection, because we deleted our 190 08:03.170 --> 08:03.920 custom one. 191 08:03.920 --> 08:07.720 And then we just restored the settings for the original one. So the moral of 192 08:07.720 --> 08:08.960 the story for most 193 08:08.960 --> 08:12.320 people is going to be if you have an event handler that you need to create a 194 08:12.320 --> 08:13.440 custom one for, it's 195 08:13.440 --> 08:17.390 very likely going to be at the instruction of for net due to something that 196 08:17.390 --> 08:18.880 just recently happened, 197 08:18.880 --> 08:22.850 and you need to temporarily create your own event handler, because in a matter 198 08:22.850 --> 08:23.520 of days, or when 199 08:23.520 --> 08:27.300 the next update comes out, it's very likely that whatever problem they had 200 08:27.300 --> 08:28.640 identified on the network, 201 08:28.640 --> 08:32.170 they're probably going to update with a default event handler to address the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 201 08:28.640 --> 08:32.170 they're probably going to update with a default event handler to address the 202 08:32.170 --> 08:33.280 current situation.