WEBVTT

1
00:00.000 --> 00:03.760
In this video, I'd like to walk you through the birth of an incident.

2
00:03.760 --> 00:07.920
And because there's a few ways that that new incident can be created, I'd like

3
00:07.920 --> 00:08.480
to demonstrate

4
00:08.480 --> 00:11.690
them. So one of the first ways of creating an incident would be to take an

5
00:11.690 --> 00:12.960
existing event

6
00:12.960 --> 00:17.200
and then manually right clicking and say that we want to create a new incident

7
00:17.200 --> 00:18.480
based on that event.

8
00:18.480 --> 00:21.840
So let's start there. So here at the 40 Analyzer, starting off, let's go to

9
00:21.840 --> 00:22.960
incident events. We'll

10
00:22.960 --> 00:27.600
go to the event monitor and then let's go ahead and take a look at the last few

11
00:27.600 --> 00:28.400
weeks. I'll say

12
00:28.400 --> 00:34.000
the last three weeks and we are looking at all events from all devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.400 --> 00:34.000
the last three weeks and we are looking at all events from all devices.

13
00:34.000 --> 00:35.360
Fantastic. So let's put

14
00:35.360 --> 00:39.770
a filter in place. In fact, we created some custom views where we have a view

15
00:39.770 --> 00:40.960
looking just for

16
00:40.960 --> 00:45.390
critical so we can choose that and just look at our critical events. And let's

17
00:45.390 --> 00:46.720
open up this top one

18
00:46.720 --> 00:50.040
and this is regarding IPS. What we could do is we could right click on the

19
00:50.040 --> 00:50.480
heading here,

20
00:50.480 --> 00:54.290
which includes all four of these events. And then what we could do is from the

21
00:54.290 --> 00:54.720
drop down,

22
00:54.720 --> 00:58.910
after right clicking, click right here on create new incident. This is an

23
00:58.910 --> 01:00.480
example of what is in the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:58.910 --> 01:00.480
example of what is in the

24
01:00.480 --> 01:05.210
documentation termed as raising an incident or creating an incident from these

25
01:05.210 --> 01:06.160
events. So we'll

26
01:06.160 --> 01:11.560
click here on create new incident. So let's go ahead and rename this to a SQL

27
01:11.560 --> 01:12.800
injection activity

28
01:12.800 --> 01:16.640
or maybe we say possible SQL injection activity. In fact, let's just call it

29
01:16.640 --> 01:17.520
possible malicious

30
01:17.520 --> 01:21.130
content from a client and in fact, we'll call it a device because it may not be

31
01:21.130 --> 01:22.560
a user. It could

32
01:22.560 --> 01:25.990
actually be a device on our network that has malware that's trying to do a SQL

33
01:25.990 --> 01:26.960
injection attack

34
01:26.960 --> 01:30.940
through the firewalls. Then we have incident categories. So from the drop down,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:26.960 --> 01:30.940
through the firewalls. Then we have incident categories. So from the drop down,

35
01:30.940 --> 01:31.680
let's go ahead

36
01:31.680 --> 01:35.620
and let's just for now we can call it improper usage. And then for the miter

37
01:35.620 --> 01:37.200
tech ID, if we

38
01:37.200 --> 01:41.740
knew specifically where it fell into, we could go ahead and select it. So if we

39
01:41.740 --> 01:42.640
scroll down,

40
01:42.640 --> 01:46.250
we can also search. So let me see if there's a SQL option here. It's not a

41
01:46.250 --> 01:47.680
stored procedure. So

42
01:47.680 --> 01:50.200
I'm going to go ahead and leave that blank for now because I don't think it's a

43
01:50.200 --> 01:50.960
really great match

44
01:50.960 --> 01:54.510
for it. We'll click on cancel. And then for this severity, because all those

45
01:54.510 --> 01:56.000
events were labeled as

46
01:56.000 --> 01:59.480
critical, I'll go ahead and leave that as high. Fantastic. And then for the

47
01:59.480 --> 02:00.480
affected endpoint,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:59.480 --> 02:00.480
affected endpoint,

48
02:00.480 --> 02:04.890
it's already baked in because of the IP address associated with those events

49
02:04.890 --> 02:05.680
that were created

50
02:05.680 --> 02:08.720
by the event handlers. And then for here, we'll say not sure what's going on,

51
02:08.720 --> 02:10.160
but want to find out.

52
02:10.160 --> 02:13.270
And then as far as assigning it, we could go ahead and assign it to any of our

53
02:13.270 --> 02:14.400
users. So

54
02:14.400 --> 02:18.820
I'll go ahead and assign this to the admin and then click on OK. And bada bing

55
02:18.820 --> 02:19.680
bada boom.

56
02:19.680 --> 02:24.550
We just successfully created a new incident and we attached these four events

57
02:24.550 --> 02:25.360
to the incident.

58
02:25.360 --> 02:29.490
Now where would we go to see the incident? The answer is under incidents and

59
02:29.490 --> 02:30.480
events. You got it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:29.490 --> 02:30.480
events. You got it

60
02:30.480 --> 02:34.950
right here. We'll click on incidents. And here we go. There's our brand new

61
02:34.950 --> 02:36.160
incident. It's called

62
02:36.160 --> 02:41.610
possible most activities, they're already high, affected in point 1020.102.

63
02:41.610 --> 02:42.800
There's the description,

64
02:42.800 --> 02:47.510
it's new, and it automatically gave it a incident number just incrementing from

65
02:47.510 --> 02:48.320
where it left off.

66
02:48.320 --> 02:52.690
So in earlier, I created a few incidents in preparation for this. And so I

67
02:52.690 --> 02:53.840
deleted them all before now,

68
02:53.840 --> 02:57.710
but now we're up to incident number a whole bunch of zeros and a nine. And as

69
02:57.710 --> 02:58.560
far as the columns,

70
02:58.560 --> 03:02.200
if you want to do less columns, you can. And then if we scroll over, in fact,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:58.560 --> 03:02.200
if you want to do less columns, you can. And then if we scroll over, in fact,

71
03:02.200 --> 03:03.120
let me just collapse

72
03:03.120 --> 03:06.610
the left hand side, we're under incidents and events incidents. And if we

73
03:06.610 --> 03:07.360
scroll over to the

74
03:07.360 --> 03:11.240
right, we can see the additional columns here. So there's the reporter and the

75
03:11.240 --> 03:12.240
incident category.

76
03:12.240 --> 03:15.490
And if we wanted to see or not see some of these columns, we could simply

77
03:15.490 --> 03:16.480
remove them by using the

78
03:16.480 --> 03:21.370
gear icon, which would control our columns for us. Fantastic. Also over here

79
03:21.370 --> 03:21.760
has a nice

80
03:21.760 --> 03:24.970
church grant severity status and category. If you don't want to see those, you

81
03:24.970 --> 03:25.600
can just right

82
03:25.600 --> 03:28.730
here toggle these show charts option and it removes it. If you want to see them

83
03:28.730 --> 03:29.600
back, you can click

84
03:29.600 --> 03:32.480
there to bring them back. And if you want to control which chart show up, there
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:29.600 --> 03:32.480
there to bring them back. And if you want to control which chart show up, there

85
03:32.480 --> 03:33.040
's severity,

86
03:33.040 --> 03:36.850
status, category, and outbreaks, we could go ahead and control that by simply

87
03:36.850 --> 03:37.760
using the drop down

88
03:37.760 --> 03:41.450
and selecting the charts we want to see. So I'll go ahead and use that. And

89
03:41.450 --> 03:41.600
that way,

90
03:41.600 --> 03:46.070
it's a nice overview of the current incidents. Think of it like a ticketing

91
03:46.070 --> 03:47.440
system for looking

92
03:47.440 --> 03:51.330
at problems on the network. Now, another way of creating an incident would be

93
03:51.330 --> 03:52.320
to go here in the

94
03:52.320 --> 03:56.310
instance and events and instance, and then simply clicking on create new, which

95
03:56.310 --> 03:57.120
is yet another way

96
03:57.120 --> 04:01.540
to create an incident. So go ahead and say demo incident, we could go ahead and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:57.120 --> 04:01.540
to create an incident. So go ahead and say demo incident, we could go ahead and

97
04:01.540 --> 04:02.720
say categorized

98
04:02.720 --> 04:07.760
as malicious code. If we knew the minor tech ID, let's go ahead and search for

99
04:07.760 --> 04:09.840
code as an example.

100
04:09.840 --> 04:13.280
And I don't see a perfect match there. So I'll leave that off for now. And then

101
04:13.280 --> 04:14.000
for the status,

102
04:14.000 --> 04:16.720
we'll go ahead and leave it as new. And then we get assigned this or not

103
04:16.720 --> 04:17.680
assigned it. And then

104
04:17.680 --> 04:21.260
we'll go ahead and click on OK. So now we have this incident. And now for that

105
04:21.260 --> 04:22.240
incident, we could

106
04:22.240 --> 04:26.060
take other events, for example, that we see and add them to this incident. So

107
04:26.060 --> 04:27.040
we go back to event

108
04:27.040 --> 04:33.190
monitor. And let's go ahead and describe this one right here. I will take all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:27.040 --> 04:33.190
monitor. And let's go ahead and describe this one right here. I will take all

109
04:33.190 --> 04:34.480
these events and

110
04:34.480 --> 04:38.540
let's right click and simply right here from the drop down, say add to existing

111
04:38.540 --> 04:39.200
incident.

112
04:39.200 --> 04:43.120
It'll ask us which one will select this one right here, number 10 and click on

113
04:43.120 --> 04:44.480
OK. So now

114
04:44.480 --> 04:47.760
we've successfully attached those 17 events. So if we go back to incidents,

115
04:47.760 --> 04:48.960
there it is. And now

116
04:48.960 --> 04:53.850
if we double click on it, it has all those events attached to it and associated

117
04:53.850 --> 04:54.640
with it. And if

118
04:54.640 --> 04:58.720
you scroll down, here we can see those events again, just as a demo. All right,

119
04:58.720 --> 04:59.760
so that's two ways

120
04:59.760 --> 05:04.200
that we can create incidents here manually, or we can do it right from event
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:59.760 --> 05:04.200
that we can create incidents here manually, or we can do it right from event

121
05:04.200 --> 05:04.800
monitor,

122
05:04.800 --> 05:08.760
grab the events that we want to use, right click, and then create a new

123
05:08.760 --> 05:10.400
incident from those events.

124
05:10.400 --> 05:16.030
Now another option is we could create a brand new incident based on an event

125
05:16.030 --> 05:17.200
handler that's been

126
05:17.200 --> 05:21.780
programmed to create a new incident when a certain set of conditions have been

127
05:21.780 --> 05:22.960
matched. So if we

128
05:22.960 --> 05:26.680
go to our event handlers, let's go ahead and let's clone our default botnet

129
05:26.680 --> 05:27.520
communication

130
05:27.520 --> 05:30.860
detection. We'll right click on that. We'll clone it. We'll call looking for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
05:27.520 --> 05:30.860
detection. We'll right click on that. We'll clone it. We'll call looking for

131
05:30.860 --> 05:31.920
botnet activity,

132
05:31.920 --> 05:35.980
click on OK, and then I'll take the default one here. I'm going to right click

133
05:35.980 --> 05:37.040
and just disable it.

134
05:37.040 --> 05:40.610
So now if we go to more, and if I refresh this page, it should show as disabled

135
05:40.610 --> 05:41.520
. So if I go to

136
05:41.520 --> 05:46.960
only show custom, there's our looking for botnet activity. And let's take a

137
05:46.960 --> 05:48.080
look at the details

138
05:48.080 --> 05:52.730
for this event handler. So we'll double click on it. And currently, it says

139
05:52.730 --> 05:53.680
regarding automatically

140
05:53.680 --> 05:58.550
create incident, it's disabled. So if we enable that, what that means is that

141
05:58.550 --> 05:59.520
any of these rules

142
05:59.520 --> 06:03.990
that they're matched, not only will it create an event, but it'll also add that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:59.520 --> 06:03.990
that they're matched, not only will it create an event, but it'll also add that

143
06:03.990 --> 06:05.040
event to a brand

144
06:05.040 --> 06:09.030
new incident. So let's click on OK. And let me also add a column here and then

145
06:09.030 --> 06:10.240
click on the gear.

146
06:10.240 --> 06:13.490
And I'm going to add the column for automatically create incident. And that's

147
06:13.490 --> 06:14.480
great. And that way,

148
06:14.480 --> 06:18.110
we can see when it happens. There we go. There's that column. Fantastic. It

149
06:18.110 --> 06:18.720
doesn't need all that

150
06:18.720 --> 06:22.690
space. We'll say automatically create incident. Fantastic. And now that that's

151
06:22.690 --> 06:23.280
enabled,

152
06:23.280 --> 06:28.510
let's go ahead and try to do name resolution for a domain associated with the

153
06:28.510 --> 06:29.520
command and control

154
06:29.520 --> 06:34.700
network. So let's go back to PC to. And as PC to is going out to the internet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
06:29.520 --> 06:34.700
network. So let's go back to PC to. And as PC to is going out to the internet

155
06:34.700 --> 06:35.760
and doing DNS,

156
06:35.760 --> 06:40.740
out to a public DNS server, firewall one has the policies in place to say, if

157
06:40.740 --> 06:41.200
you're doing name

158
06:41.200 --> 06:45.070
resolution, and that name is associated with the command and control network, I

159
06:45.070 --> 06:45.520
'm going to go

160
06:45.520 --> 06:50.280
ahead and not allow it. I'm going to send you back the redirect IP addresses

161
06:50.280 --> 06:51.760
configured in my DNS

162
06:51.760 --> 06:55.280
policy. So let's confirm that first on firewall one. So over to firewall one,

163
06:55.280 --> 06:56.720
we go. And let's go

164
06:56.720 --> 07:01.450
down to security profiles. And let's go to DNS filter. And there's our DNS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
06:56.720 --> 07:01.450
down to security profiles. And let's go to DNS filter. And there's our DNS

165
07:01.450 --> 07:02.320
filter is currently

166
07:02.320 --> 07:05.470
being used. And if we look at the references column, click there, it's

167
07:05.470 --> 07:06.480
currently being used in this

168
07:06.480 --> 07:10.870
end out with LDAP policy, which is perfect. So go ahead and close that. And let

169
07:10.870 --> 07:11.680
's edit the DNS

170
07:11.680 --> 07:16.240
filter just so we can see some of the domains. So it has over 80,000 domains in

171
07:16.240 --> 07:17.600
the botnet package.

172
07:17.600 --> 07:20.720
And we're currently doing a redirect. Let me go ahead and click share on botnet

173
07:20.720 --> 07:21.200
package.

174
07:21.200 --> 07:26.320
In fact, before we do that, let me also change just for grands the redirect. So

175
07:26.320 --> 07:27.040
here in our DNS

176
07:27.040 --> 07:30.920
filter, let me go down and I'm going to use two addresses are very, very easy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
07:27.040 --> 07:30.920
filter, let me go down and I'm going to use two addresses are very, very easy

177
07:30.920 --> 07:31.840
to recognize for

178
07:31.840 --> 07:35.590
the redirect both for IP before and IPB six. So let me go to the CLI. That's a

179
07:35.590 --> 07:36.480
really quick way of

180
07:36.480 --> 07:41.490
getting to the right section here. And so here, let me do a set redirect portal

181
07:41.490 --> 07:45.120
of 10.67.83.1.

182
07:46.560 --> 07:54.560
And let me also do it for IPB six. So I'll use 2001 colon 6 783 colon colon one

183
07:54.560 --> 07:55.120
. And it doesn't

184
07:55.120 --> 07:59.400
like that because I need to use the redirect portal six. All right, better,

185
07:59.400 --> 08:00.320
better, better.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
07:59.400 --> 08:00.320
better, better.

186
08:00.320 --> 08:03.930
We'll do a show. And now we take a look at our configuration. Here's the two

187
08:03.930 --> 08:04.400
redirected

188
08:04.400 --> 08:08.360
dresses, we'll type it end, and then we'll exit out and cancel that so we don't

189
08:08.360 --> 08:09.120
reset it back to

190
08:09.120 --> 08:13.140
the dot 100. So if we go into our DNS filter, just to confirm, we scroll down

191
08:13.140 --> 08:14.880
1067 a three dot one.

192
08:14.880 --> 08:20.430
And for IPB six, it'll be the 2001 6 783 address. So now it's in place, we'll

193
08:20.430 --> 08:21.360
cancel no new changes

194
08:21.360 --> 08:25.000
there. And back to the 40 Eliza with our looking for botnet activity, we should

195
08:25.000 --> 08:25.920
have a match on

196
08:25.920 --> 08:30.470
this rule right here. So let's go ahead and test. Oh, I know, I need to go back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
08:25.920 --> 08:30.470
this rule right here. So let's go ahead and test. Oh, I know, I need to go back

197
08:30.470 --> 08:31.920
to firewall one.

198
08:31.920 --> 08:34.710
So I can see some of the domains associated with botnet. So let me go back here

199
08:34.710 --> 08:35.360
. That's where I

200
08:35.360 --> 08:38.140
need to see to see some of those names. And let's bring in our client. All

201
08:38.140 --> 08:39.600
right, so here's PC to

202
08:40.160 --> 08:44.440
already in interactive mode for NS lookup. And let's go ahead and scroll down a

203
08:44.440 --> 08:45.920
little bit here.

204
08:45.920 --> 08:50.750
Let's grab some new ones. How about SA one at dot r u, the actual response was

205
08:50.750 --> 08:51.520
coming back.

206
08:51.520 --> 08:55.040
And the 40 gate firewall said, Oh, no, I'm going to redirect you to the address

207
08:55.040 --> 08:55.920
to set up in that

208
08:55.920 --> 08:59.680
DNS profile. That'll be enough. I mean, he is one. So let me go ahead and take

209
08:59.680 --> 09:00.320
the client,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

209
08:59.680 --> 09:00.320
the client,

210
09:00.320 --> 09:04.660
minimize it. And let's also cancel that here at firewall one. Let's go back to

211
09:04.660 --> 09:05.760
the 40 analyzer.

212
09:05.760 --> 09:10.160
So we're the 40 analyzer. The events here should increment once that happens.

213
09:10.160 --> 09:11.520
But if we go now to

214
09:11.520 --> 09:15.870
event monitor, let's take a look at the last five minutes. So great, we have

215
09:15.870 --> 09:16.400
some events that

216
09:16.400 --> 09:19.550
have been created. And it's also showing us here the handler that created it.

217
09:19.550 --> 09:20.640
So there's our

218
09:20.640 --> 09:25.200
event handler. So we click on looking for botnet activity is then going to show

219
09:25.200 --> 09:26.240
us exactly which

220
09:26.240 --> 09:31.640
rules match fantastic. So we have the event and also because that was triggered
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

220
09:26.240 --> 09:31.640
rules match fantastic. So we have the event and also because that was triggered

221
09:31.640 --> 09:32.640
, we also should

222
09:32.640 --> 09:37.740
have a related incident, which includes the event. So if we go to incidents now

223
09:37.740 --> 09:38.000
,

224
09:38.000 --> 09:43.160
that, here's that latest incident. So if I sort by number, and I put 11 here at

225
09:43.160 --> 09:44.240
the bottom,

226
09:44.240 --> 09:47.960
there it is right there. So it named it that name. So we double click on that

227
09:47.960 --> 09:48.400
incident,

228
09:48.400 --> 09:52.090
we can actually change the name now to something more of our liking. But the

229
09:52.090 --> 09:52.560
point I wanted to

230
09:52.560 --> 09:56.920
share here is that to get incidents, we can manually create them. We can raise

231
09:56.920 --> 09:58.400
them from existing events,

232
09:58.400 --> 10:02.150
or we can have an event handler that says in addition to creating event, when
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

232
09:58.400 --> 10:02.150
or we can have an event handler that says in addition to creating event, when

233
10:02.150 --> 10:02.960
the rules are matched,

234
10:02.960 --> 10:06.830
we also want to go ahead and automatically create an incident, which is what we

235
10:06.830 --> 10:07.520
're showing

236
10:07.520 --> 10:10.790
right here. Let me close that. And so the next logical question is, okay, great

237
10:10.790 --> 10:11.440
. Now we have an

238
10:11.440 --> 10:14.830
incident. What do we do with it? And that, my friend, is what we get to talk

239
10:14.830 --> 10:15.680
about in the very

240
10:15.680 --> 10:18.720
next video. So I'll see you there in just a moment.