WEBVTT 1 00:00.000 --> 00:04.080 To wrap up this set of videos regarding events on the 40 Analyzer, 2 00:04.080 --> 00:08.720 I like to propose a customer scenario and that's this. A customer that has 3 00:08.720 --> 00:09.920 hired us to come in and 4 00:09.920 --> 00:15.820 consult for them, they're confused about the distinction between events on a 40 5 00:15.820 --> 00:16.480 -gate firewall, 6 00:16.480 --> 00:22.000 for example, like firewall one, and events on the 40 Analyzer. So my question 7 00:22.000 --> 00:22.960 for you is, 8 00:22.960 --> 00:26.160 as we're going to go meet with the customer, you and I should have a little pow 9 00:26.160 --> 00:27.040 wow first 10 00:27.040 --> 00:31.450 before we go chat with them. And my question is, how would you explain the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:27.040 --> 00:31.450 before we go chat with them. And my question is, how would you explain the 11 00:31.450 --> 00:32.240 differences 12 00:32.240 --> 00:35.660 with the events on the 40-gate versus the events on the 40-analyzer to the 13 00:35.660 --> 00:36.320 customer? 14 00:36.320 --> 00:39.600 So here's what I would love you to do right now. Go ahead and pause the video, 15 00:39.600 --> 00:43.680 think about how you would best explain it to the customer, and then when you're 16 00:43.680 --> 00:44.320 ready, 17 00:44.320 --> 00:48.680 I'd like you to hit resume and we can talk about it together in preparation for 18 00:48.680 --> 00:49.360 meeting with that 19 00:49.360 --> 00:55.510 customer. So let's have a little pregame meeting before we meet with the 20 00:55.510 --> 00:56.480 customer. 21 00:56.960 --> 01:01.100 A couple of thoughts. Number one, we probably want to just chat with them about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:56.960 --> 01:01.100 A couple of thoughts. Number one, we probably want to just chat with them about 22 01:01.100 --> 01:02.080 the log messages 23 01:02.080 --> 01:05.560 on the 40-gate by itself, which when it sends those over to the 40-analyzer, 24 01:05.560 --> 01:06.480 those are going to be 25 01:06.480 --> 01:10.440 sent over as raw logs, and then 40-analyzer is going to do a few things with 26 01:10.440 --> 01:11.680 them. But on the local 27 01:11.680 --> 01:15.720 40-gate firewall, the events would be like security events, web filtering, 28 01:15.720 --> 01:16.960 application control, 29 01:16.960 --> 01:20.720 DNS, and so forth. But at that point, they're just logs. So we can say that the 30 01:20.720 --> 01:21.840 40-gate is going 31 01:21.840 --> 01:25.930 to go ahead and send those logs over to the 40-analyzer. Now, we probably don't 32 01:25.930 --> 01:27.200 need to tell the customer 33 01:27.200 --> 01:31.520 that the 40-analyzer receives those as raw log events and then puts them into a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 33 01:27.200 --> 01:31.520 that the 40-analyzer receives those as raw log events and then puts them into a 34 01:31.520 --> 01:32.480 SQL database. 35 01:32.480 --> 01:35.910 You and I know that, but the customer may not care about that too much. However 36 01:35.910 --> 01:36.640 , what they would 37 01:36.640 --> 01:41.360 care about is that we could tell them that the 40-analyzer has a set of rules 38 01:41.360 --> 01:41.840 that it's looking 39 01:41.840 --> 01:45.800 at regarding incoming log messages. And let me rewrite rules there to make it 40 01:45.800 --> 01:46.960 look like rules. 41 01:46.960 --> 01:51.360 Rules, there we go. And so based on those rules with things that are happening 42 01:51.360 --> 01:51.920 with those log 43 01:51.920 --> 01:56.240 events, for example, like administrator failing to log in a certain number of 44 01:56.240 --> 01:57.760 times, or a 40-gate 45 01:57.760 --> 02:03.200 firewall that's blocking DNS requests to a malicious domain based on the 40- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 01:57.760 --> 02:03.200 firewall that's blocking DNS requests to a malicious domain based on the 40- 46 02:03.200 --> 02:03.920 analyzer, 47 02:03.920 --> 02:07.400 seeing those logs and then comparing against the rules, it's then going to go 48 02:07.400 --> 02:08.160 ahead and then 49 02:08.160 --> 02:13.180 create events on the 40-analyzer that can then be used to see what's happening. 50 02:13.180 --> 02:14.000 Now, if we wanted 51 02:14.000 --> 02:18.000 to, we could also give them a little extra info and see that these rules that 52 02:18.000 --> 02:18.720 are being looked at 53 02:18.720 --> 02:22.520 on the 40-analyzer that are creating the events, we could let them know that 54 02:22.520 --> 02:23.200 what's created those 55 02:23.200 --> 02:28.100 events is called the event handlers. And then furthermore, once we watch the 56 02:28.100 --> 02:29.600 next skill that is, 57 02:29.600 --> 02:33.280 you and I could then tell them also that based on all these events, we could WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 57 02:29.600 --> 02:33.280 you and I could then tell them also that based on all these events, we could 58 02:33.280 --> 02:34.320 then organize them 59 02:34.320 --> 02:39.500 into tickets. Now, in the world of 40-analyzer, they call those tickets "inc 60 02:39.500 --> 02:40.320 idents." And the 61 02:40.320 --> 02:44.720 great news about "incidents and incident management" is that's the exact next 62 02:44.720 --> 02:45.360 topic that we're going 63 02:45.360 --> 02:49.050 to talk about in our next set of videos, in our next skill. And I look forward 64 02:49.050 --> 02:50.000 to seeing you, my 65 02:50.000 --> 02:54.400 friend, in the next skill in the near future. But until then, I hope this has 66 02:54.400 --> 02:55.440 been informative, 67 02:55.440 --> 02:58.480 and I'd like to thank you for viewing.