WEBVTT 1 00:00.000 --> 00:02.240 In this video, I like to take the next logical steps 2 00:02.240 --> 00:05.040 and helping to figure out what is going on 3 00:05.040 --> 00:08.000 regarding the activity behind this incident. 4 00:08.000 --> 00:11.680 So we already know that we have the events that have been created. 5 00:11.680 --> 00:16.800 Those events have been, let me go ahead and specify for the last three weeks. 6 00:16.800 --> 00:18.560 And if we modify the columns here. 7 00:18.560 --> 00:21.840 So here in Event Monitor, we know that we have some events that have been 8 00:21.840 --> 00:22.240 created. 9 00:22.240 --> 00:24.640 In fact, I'll go ahead and use our custom filter. 10 00:24.640 --> 00:26.480 In fact, these are our custom view. 11 00:26.480 --> 00:28.400 And we'll go ahead and select critical. 12 00:28.400 --> 00:32.880 So we took these four events and included them as part of an incident. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 12 00:28.400 --> 00:32.880 So we took these four events and included them as part of an incident. 13 00:32.880 --> 00:34.720 So that incident is right here. 14 00:34.720 --> 00:37.200 So let me go ahead and collapse the left hand side. 15 00:37.200 --> 00:40.800 And in the last video, we also set it to the status of analysis, meaning we're 16 00:40.800 --> 00:41.520 looking into it. 17 00:41.520 --> 00:44.080 So let's go ahead and double click and scroll down. 18 00:44.080 --> 00:46.960 And from right here, if we go down to the actual events, 19 00:46.960 --> 00:50.000 we can actually drill into these events to find out what's happening. 20 00:50.000 --> 00:51.760 Now reviewing logs, we have a few options. 21 00:51.760 --> 00:56.000 One is we could go ahead and right click and say view logs or search and log 22 00:56.000 --> 00:56.160 view. 23 00:56.160 --> 00:59.600 We could also click on the buttons here for view logs or search and log view. 24 00:59.600 --> 01:00.560 So we do view logs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 00:59.600 --> 01:00.560 So we do view logs. 25 01:00.560 --> 01:04.160 It's going to bring up that log information in the same pane and the same tab 26 01:04.160 --> 01:04.800 and same window. 27 01:04.800 --> 01:06.080 So we can double click here. 28 01:06.080 --> 01:07.280 It's going to show us the details. 29 01:07.280 --> 01:09.600 But if we want to go to the actual logs themselves, 30 01:09.600 --> 01:13.390 we're going to want to do a search and log view, which takes us to a separate 31 01:13.390 --> 01:13.920 window, 32 01:13.920 --> 01:15.360 logged onto for the analyzer. 33 01:15.360 --> 01:17.600 And that way we can come back to this window and continue. 34 01:17.600 --> 01:21.240 So as a demonstration, we right click and we'll go ahead and do a search and 35 01:21.240 --> 01:21.840 log view, 36 01:21.840 --> 01:23.200 which brings up a new window. 37 01:23.200 --> 01:26.240 And then from here, we can sort and start looking at the details for our logs. 38 01:26.240 --> 01:30.750 Another really cool option right here in this flavor of the 40 analyzers that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 01:26.240 --> 01:30.750 Another really cool option right here in this flavor of the 40 analyzers that 39 01:30.750 --> 01:31.760 under log view and logs, 40 01:31.760 --> 01:34.320 we have this tab right here for threat hunting. 41 01:34.320 --> 01:37.630 So currently it's looking at the last hour and the attacks that we were looking 42 01:37.630 --> 01:38.480 at happened a while back. 43 01:38.480 --> 01:42.720 So I'm going to say the last, how about the last 14 days. 44 01:42.720 --> 01:46.280 And then here with threat hunting, we have options for sorting based on threat 45 01:46.280 --> 01:48.880 action or threat pattern or threat name. 46 01:48.880 --> 01:50.320 And why would you just source IP? 47 01:50.320 --> 01:55.520 So if we go back to the logs and we do a view logs here, it's at 1020 0.102. 48 01:55.520 --> 01:56.400 That's the source. 49 01:56.400 --> 02:00.640 So if we go back to our threat hunting and sort based on IP, there's 1020 012, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 01:56.400 --> 02:00.640 So if we go back to our threat hunting and sort based on IP, there's 1020 012, 50 02:00.640 --> 02:04.200 we could right click on that and say add to hunting, which puts a filter in for 51 02:04.200 --> 02:06.000 us or just that source IP. 52 02:06.000 --> 02:10.320 And then all the output here is going to be limited to just that IP address. 53 02:10.320 --> 02:12.720 So we got a threat action or threat name. 54 02:12.720 --> 02:14.880 It's all filtering based on that source IP address. 55 02:14.880 --> 02:16.800 So there's our SQL injection right there. 56 02:17.360 --> 02:20.160 So if we double clicked on that, it puts the filter in for us. 57 02:20.160 --> 02:24.560 And this device at 1020 0.102 has been a pretty busy device. 58 02:24.560 --> 02:27.850 So we go to the columns, we can choose remove columns or we can reset it to 59 02:27.850 --> 02:28.480 default. 60 02:28.480 --> 02:30.960 So I take a closer look at the details, just double click. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 02:28.480 --> 02:30.960 So I take a closer look at the details, just double click. 61 02:30.960 --> 02:32.240 And here's the entry for that lock. 62 02:32.240 --> 02:34.880 So this is a source from HQ firewall one. 63 02:34.880 --> 02:37.040 There's the date and timestamps. 64 02:37.040 --> 02:38.880 The event action was dropped. 65 02:38.880 --> 02:42.800 It was due to the security profile called block severity levels four and five. 66 02:42.800 --> 02:44.640 So if we're on the threat, it was blocked. 67 02:44.640 --> 02:48.560 And the threat name was HTTP or I SQL injection. 68 02:48.560 --> 02:49.920 And there's the threat pattern. 69 02:49.920 --> 02:53.880 And if we continue to scroll down, has information about our user was 80 user 70 02:53.880 --> 02:54.400 two. 71 02:54.400 --> 02:59.120 And they were going to test fire.net, which is a I think supported by IBM. 72 02:59.120 --> 03:00.560 And it's intentionally vulnerable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 72 02:59.120 --> 03:00.560 And it's intentionally vulnerable. 73 03:00.560 --> 03:02.880 It's not a production site, but it's intentionally vulnerable. 74 03:02.880 --> 03:05.040 So people can test things like SQL injections. 75 03:05.040 --> 03:09.500 But our users should not be attempting SQL injections going through our firew 76 03:09.500 --> 03:10.000 alls. 77 03:10.000 --> 03:13.960 So if we determine that was the case, what we could then do is go back into 78 03:13.960 --> 03:14.320 this 79 03:14.320 --> 03:15.360 and update it. 80 03:15.360 --> 03:19.520 So I go ahead and close this and close this and let's go back to our main tab 81 03:19.520 --> 03:19.920 for our 40 82 03:19.920 --> 03:21.200 analysts, which is right here. 83 03:21.200 --> 03:23.600 And then we can go ahead and update this. 84 03:23.600 --> 03:29.320 So in the comments, we get out of comment, such as user going to test SQL 85 03:29.320 --> 03:30.880 injection. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 85 03:29.320 --> 03:30.880 injection. 86 03:30.880 --> 03:31.840 Not a real threat. 87 03:31.840 --> 03:35.200 Now, also, we probably want to go to 80 user two. 88 03:35.200 --> 03:40.880 If that's what our end users, why are they practicing SQL injection attacks? 89 03:40.880 --> 03:44.640 The answer is they probably shouldn't be from our corporate network going 90 03:44.640 --> 03:45.680 through our firewalls. 91 03:45.680 --> 03:50.080 Because in this case, it was going to a test website, but they could be going 92 03:50.080 --> 03:51.040 to an actual, 93 03:51.040 --> 03:53.760 you know, production site attempting SQL injection attacks. 94 03:53.760 --> 03:55.200 And then that would be a real problem. 95 03:55.200 --> 03:56.960 So we'll go ahead and click on post here. 96 03:56.960 --> 04:00.320 And that way our other teammates were also adding comments to this can know WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 96 03:56.960 --> 04:00.320 And that way our other teammates were also adding comments to this can know 97 04:00.320 --> 04:01.040 what's going on. 98 04:01.040 --> 04:04.240 And then we'll go back and we can right click on this, click on edit. 99 04:04.240 --> 04:07.680 And it'll go ahead and change the severity to, you know, something other than 100 04:07.680 --> 04:08.160 high. 101 04:08.160 --> 04:11.760 So we'll go ahead and say 80 user to practicing SQL injection attacks. 102 04:11.760 --> 04:16.240 And then for the status, we'll change it from analysis to false positive. 103 04:16.240 --> 04:20.000 Now, also, if we needed to follow up that end user, that would be, you know, 104 04:20.000 --> 04:21.680 saying to include the notes as well. 105 04:21.680 --> 04:24.560 So we'll go ahead and close it, click on OK. 106 04:24.560 --> 04:26.320 And now that status is closed. 107 04:26.320 --> 04:30.080 Also right here from these charts, if we wanted to go ahead and click on them, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 107 04:26.320 --> 04:30.080 Also right here from these charts, if we wanted to go ahead and click on them, 108 04:30.080 --> 04:33.650 for example, if we click next to new or say zero, we click there, it puts a 109 04:33.650 --> 04:34.720 filter in place, 110 04:34.720 --> 04:37.760 only showing us new incidents. 111 04:37.760 --> 04:39.760 And because there aren't any, the list is empty. 112 04:39.760 --> 04:43.990 So we click on the funnel there, go back to the closed, click on that, it'll 113 04:43.990 --> 04:44.640 take us to that. 114 04:44.640 --> 04:48.400 So that way you can sort based on these charts as well, just by clicking on the 115 04:48.400 --> 04:51.040 hyperlinks for each of the options.