a visual approach to security event management eusecwest ‘06, london raffael marty, gcia, cissp...

A Visual Approach to Security Event Management

EuSecWest ‘06, LondonRaffael Marty, GCIA, CISSPSenior Security Engineer @ ArcSight

February 21th, 2006

Raffael Marty 2EuSecWest 2006 London

Raffael Marty, GCIA, CISSP

Enterprise Security Management (ESM) specialist

Strategic Application Solutions @ ArcSight, Inc.

Intrusion Detection Research @ IBM Research

See http://thor.cryptojail.net

IT Security Consultant @ PriceWaterhouse Coopers

Open Vulnerability and Assessment Language (OVAL) board member

Passion for Visual Security Event Analysis

Table Of Contents

► Introduction

►Basics

►Examples of Graphs you can draw with AfterGlow

►AfterGlow

1.x – Event Graphs

2.0 – TreeMaps

Future – All in One!

Introduction

Disclaimer

IP addresses and host names showingup in event graphs and descriptions were obfuscated/changed. The addresses are

completely random and any resemblancewith well-known addresses or host names

are purely coincidental.

Jun 17 09:42:30 rmarty ifup: Determining IP information for eth0...Jun 17 09:42:35 rmarty ifup: failed; no link present. Check cable?Jun 17 09:42:35 rmarty network: Bringing up interface eth0: failedJun 17 09:42:38 rmarty sendmail: sendmail shutdown succeededJun 17 09:42:38 rmarty sendmail: sm-client shutdown succeededJun 17 09:42:39 rmarty sendmail: sendmail startup succeededJun 17 09:42:39 rmarty sendmail: sm-client startup succeededJun 17 09:43:39 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 09:45:42 rmarty last message repeated 2 timesJun 17 09:45:47 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 09:56:02 rmarty vmnet-dhcpd: DHCPDISCOVER from 00:0c:29:b7:b2:47 via vmnet8Jun 17 09:56:03 rmarty vmnet-dhcpd: DHCPOFFER on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8Jun 17 09:56:03 rmarty vmnet-dhcpd: DHCPREQUEST for 172.16.48.128 from 00:0c:29:b7:b2:47 via vmnet8Jun 17 09:56:03 rmarty vmnet-dhcpd: DHCPACK on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:00:03 rmarty crond(pam_unix)[30534]: session opened for user root by (uid=0)Jun 17 10:00:10 rmarty crond(pam_unix)[30534]: session closed for user rootJun 17 10:01:02 rmarty crond(pam_unix)[30551]: session opened for user root by (uid=0)Jun 17 10:01:07 rmarty crond(pam_unix)[30551]: session closed for user rootJun 17 10:05:02 rmarty crond(pam_unix)[30567]: session opened for user idabench by (uid=0)Jun 17 10:05:05 rmarty crond(pam_unix)[30567]: session closed for user idabenchJun 17 10:13:05 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.19/192.168.80.19 to UDP port: 192Jun 17 10:13:05 rmarty portsentry[4797]: attackalert: Host: 192.168.80.19/192.168.80.19 is already blocked IgnoringJun 17 10:14:09 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.8/192.168.80.8 to UDP port: 68Jun 17 10:14:09 rmarty portsentry[4797]: attackalert: Host: 192.168.80.8/192.168.80.8 is already blocked IgnoringJun 17 10:14:09 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.8/192.168.80.8 to UDP port: 68Jun 17 10:14:09 rmarty portsentry[4797]: attackalert: Host: 192.168.80.8/192.168.80.8 is already blocked IgnoringJun 17 10:21:30 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.8/192.168.80.8 to UDP port: 68Jun 17 10:21:30 rmarty portsentry[4797]: attackalert: Host: 192.168.80.8/192.168.80.8 is already blocked IgnoringJun 17 10:28:40 rmarty vmnet-dhcpd: DHCPDISCOVER from 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:28:41 rmarty vmnet-dhcpd: DHCPOFFER on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:28:41 rmarty vmnet-dhcpd: DHCPREQUEST for 172.16.48.128 from 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:28:45 rmarty vmnet-dhcpd: DHCPACK on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:30:47 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.8/192.168.80.8 to UDP port: 68Jun 17 10:30:47 rmarty portsentry[4797]: attackalert: Host: 192.168.80.8/192.168.80.8 is already blocked IgnoringJun 17 10:30:47 rmarty portsentry[4797]: attackalert: UDP scan from host: 192.168.80.8/192.168.80.8 to UDP port: 68Jun 17 10:30:47 rmarty portsentry[4797]: attackalert: Host: 192.168.80.8/192.168.80.8 is already blocked IgnoringJun 17 10:35:28 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 10:35:31 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 10:38:51 rmarty vmnet-dhcpd: DHCPREQUEST for 172.16.48.128 from 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:38:52 rmarty vmnet-dhcpd: DHCPACK on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8Jun 17 10:42:35 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 10:42:38 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128

Text or Visuals?

►What would you rather look at?

A Picture is Worth a Thousand Log Entries

Detect the Expected & Discover the Unexpected

Make Better DecisionsMake Better Decisions

Reduce Analysis and Response TimesReduce Analysis and Response Times

Three Aspects of Visual Security Event Analysis

► Situational Awareness• What is happening in a specific business area

(e.g., compliance monitoring)• What is happening on a specific network• What are certain servers doing

► Real-Time Monitoring and Incident Response• Capture important activities and take action• Event Workflow• Collaboration

► Forensic and Historic Investigation• Selecting arbitrary set of events for investigation• Understanding big picture• Analyzing relationships - Exploration• Reporting

Basics

How To Generate A Graph?

ParserDevice Event Visualizer

... | Normalization | ...

Jun 17 09:42:30 rmarty ifup: Determining IP information for eth0...Jun 17 09:42:35 rmarty ifup: failed; no link present. Check cable?Jun 17 09:42:35 rmarty network: Bringing up interface eth0: failedJun 17 09:42:38 rmarty sendmail: sendmail shutdown succeededJun 17 09:42:38 rmarty sendmail: sm-client shutdown succeededJun 17 09:42:39 rmarty sendmail: sendmail startup succeededJun 17 09:42:39 rmarty sendmail: sm-client startup succeededJun 17 09:43:39 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 09:45:42 rmarty last message repeated 2 timesJun 17 09:45:47 rmarty vmnet-dhcpd: DHCPINFORM from 172.16.48.128Jun 17 09:56:02 rmarty vmnet-dhcpd: DHCPDISCOVER from 00:0c:29:b7:b2:47 via vmnet8Jun 17 09:56:03 rmarty vmnet-dhcpd: DHCPOFFER on 172.16.48.128 to 00:0c:29:b7:b2:47 via vmnet8NH

Log File

Visual

Visual Types I

►Will focus on visuals that AfterGlow supports:

Event Graphs (Link Graphs)

TreeMaps

AfterGlow 1.x - Perl AfterGlow 2.0 - JAVA

Visual Types II

Event Graphs (Link Graphs)

TreeMaps

NameSIP DIP

►Node Configuration

►Node Coloring

►Edge Coloring

►Hierarchy

►”Box” Coloring

►“Box” Size

Link Graph Configurations

Raw Event:[**] [1:1923:2] RPC portmap UDP proxy attempt [**][Classification: Decode of an RPC Query] [Priority: 2] 06/04-15:56:28.219753 192.168.10.90:32859 -> 192.168.10.255:111UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:148 DFLen: 120

Different node configurations:

192.168.10.90 RPC portmap 192.168.10.255 192.168.10.90 192.168.10.255 111

192.168.10.90 32859 111 RPC portmap 192.168.10.90 192.168.10.255

SPortSIP DPort SIPName DIP

DIPSIP DPortNameSIP DIP

TreeMap Configurations

Raw Event:[**] [1:1923:2] RPC portmap UDP proxy attempt [**][Classification: Decode of an RPC Query] [Priority: 2] 06/04-15:56:28.219753 192.168.10.90:32859 -> 192.168.10.255:111UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:148 DFLen: 120

Different configurations:SIP

DIP192.168.10.255

Graph Use Cases

Things You Can Do With AfterGlow

Situational Awareness Dashboard

Vulnerability Awareness I

One Machine

A Vulnerability

Vulnerability Awareness II

AfterGlow - LGL

Monitoring Web Servers

Traffic to WebServers

Suspicious Activity?

Network Scan

Port Scan

►Port scan or something else?

PortScan

Firewall Activity

External Machine

Internal Machine

Outgoing

Incoming

Rule# DIPSIP

Next Steps: 1. Visualize “FW Blocks” of outgoing traffic

-> Why do internal machines trigger blocks?2. Visualize “FW Blocks” of incoming traffic

-> Who and what tries to enter my network?3. Visualize “FW Passes” of outgoing traffic

-> What is leaving the network?

Firewall Rule-set Analysis

pass block

Load Balancer

DefCon 2004 Capture The Flag

DstPort < 1024

DstPort > 1024

Source Of Evil

Other Team's Target

Internal Target

Internal Source

Internet Target

DPortSIP

Our Servers

Exposed Services

DefCon 2004 Capture The Flag – TTL Games

Source Of Evil

Internal Target

DIP TTLSIP

Internal Source

Offender TTL

Our Servers

DefCon 2004 Capture The Flag – More TTL

Flags TTLDPort

Show Node Counts

Telecom Malicious Code Propagation

FromPhone#

ToPhone#

ContentType|Size

Email Cliques

From: My Domain

From: Other Domain

To: Other Domain

From To

To: My Domain

Email Relays

From: My Domain

From: Other Domain

To: Other Domain

From To

To: My Domain

Do you run an open relay?

Grey out emails to and from “my domain”

Make “my domain” invisible

Email SPAM?

To Size

Size > 10.000Omit threshold = 1

Multiple recipients withsame-size messages

Email SPAM?

From nrcpt

nrcpt => 2Omit threshold = 1

BIG Emails

Size > 100.000Omit Threshold = 2

To Size

Documents leaving the network?

Email Server Problems?

2:00 < Delay < 10:00

Delay > 10:00

To Delay

AfterGlow

afterglow.sourceforge.net

AfterGlow

►http://afterglow.sourceforge.net

►Two Versions:

• AfterGlow 1.x – Perl for Event Graphs

• AfterGlow 2.0 – Java for TreeMaps

AfterGlow 1.x - Perl

►Supported graphing tools:

• GraphViz from AT&T (dot and neato) http://www.research.att.com/sw/tools/graphviz/

• LGL (Large Graph Layout) by Alex Adaihttp://bioinformatics.icmb.utexas.edu/lgl/

CSV File

Parser AfterGlow Graph LanguageFile

Grapher

AfterGlow 1.x – Command Line Parameters

● Some command line arguments:-h : help

-t : two node mode

-d : print count on nodes

-e : edge length

-n : no node labels

-o threshold : omit threshold (fan-out for nodes to be displayed)

-c configfile : color configuration file

AfterGlow 1.x – color.properties

color.[source|event|target|edge]=

<perl expression returning a color name>● Array @fields contains input-line, split into tokens:

color.event=“red” if ($fields[1] =~ /^192\..*)

● Special color “invisible”:

color.target=“invisible” if ($fields[0] eq

“IIS Action”)

● Edge color

color.edge=“blue”

AfterGlow 1.x – color.properties - Example

color.source="olivedrab" if ($fields[0]=~/191\.141\.69\.4/);

color.source="olivedrab" if ($fields[0]=~/211\.254\.110\./);

color.source="orangered1"

color.event="slateblue4"

color.target="olivedrab" if ($fields[2]=~/191\.141\.69\.4/);

color.target="olivedrab" if ($fields[2]=~/211\.254\.110\./);

color.target="orangered1"

color.edge="firebrick" if (($fields[0]=~/191\.141\.69.\.4/) or ($fields[2]=~/191\.141\.69\.4/))

color.edge="cyan4"

AfterGlow 2.0 - Java

►Command line arguments:

-h : help

-c file : property file

-f file : data file

CSV File

Parser AfterGlow - Java

Target System Type,SIP,DIP,User,OutcomeDevelopment,192.168.10.1,10.10.2.1,ram,failureVPN,192.168.10.1,10.10.2.1,ram,successFinancial System,192.168.20.1,10.0.3.1,drob,successVPN,192.168.10.1,10.10.2.1,ram,successVPN,192.168.10.1,10.10.2.1,jmoe,failureFinancial System,192.168.10.1,10.10.2.1,jmoe,successFinancial System,192.168.10.1,10.10.2.1,jmoe,failure

AfterGlow 2.0 - Example

►Data:

►Launch:

./afterglow-java.sh –c afterglow.properties

# AfterGlow - JAVA 2.0# Properties File

# File to loadfile.name=/home/ram/afterglow/data/sample.csv

# Column Types (default is STRING), start with 0!# Valid values:# STRING# INTEGER# CATEGORICAL

column.type.count=4column.type[0].column=0column.type[0].type=INTEGERcolumn.type[1].column=1column.type[1].type=CATEGORICALcolumn.type[2].column=2column.type[2].type=CATEGORICALcolumn.type[3].column=3column.type[3].type=CATEGORICAL

# Size Column (default is 0)size.column=0

# Color Column (default is 0)color.column=2

# AfterGlow - JAVA 2.0# Properties File

# File to loadfile.name=/home/ram/afterglow/data/sample.csv

# Column Types (default is STRING), start with 0!# Valid values:# STRING# INTEGER# CATEGORICAL

column.type.count=4column.type[0].column=0column.type[0].type=INTEGERcolumn.type[1].column=1column.type[1].type=CATEGORICALcolumn.type[2].column=2column.type[2].type=CATEGORICALcolumn.type[3].column=3column.type[3].type=CATEGORICAL

# Size Column (default is 0)size.column=0

# Color Column (default is 0)color.column=2

AfterGlow 2.0 – Java - Output

AfterGlow 2.0 – Java - Interaction

►Left-click:

• Zoom in

►Right-click:

• Zoom all the way out

►Middle-click

• Change Coloring to currentdepth

(Hack: Use SHIFT for leafs)

AfterGlow 3.0 – The Future

► Generating LinkGraphs with the Java version

► Adding more output formats

► Saving output as image file

► Animation

AfterGlow – Parsers

► tcpdump2csv.pl

• Takes care of swapping response source and targets

tcpdump -vttttnnelr /tmp/log.tcpdump | ./tcpdump2csv.pl "sip dip sport"

►sendmail_parser.pl

• Reassemble email conversations:Jul 24 21:01:16 rmarty sendmail[17072]: j6P41Gqt017072: from=<root@localhost.localdomain>, size=650, class=0, nrcpts=1,Jul 24 21:01:16 rmarty sendmail[17073]: j6P41Gqt017072: to=ram, ctladdr=<root@localhost.localdomain> (0/0), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30881, dsn=2.0.0, stat=Sent

Summary

Detect the expected

& discover the unexpected

Make better decisions

Reduce analysis and response times

THANKS!

raffy@arcsight.com

Raffael Marty 52EuSecWest 2006 Lodon

a visual approach to security event management eusecwest ‘06, london raffael marty, gcia, cissp...

rmarty sendmail

rmarty portsentry4797

rmarty crondpam

rmarty ifup

rmarty network

rmarty vmnetdhcpd

host names

londonraffael marty

Documents

photosynthesis pablo gcia 5ºb

gcia industrial_und 14 el rol gerencia ingeniero...

fundamentos de admon y gcia

eusecwest 2008 - abusing x509 certificate features...

giac-gcia-assignment-pass_773_ (1).pdf

pupo and raffael

teg jose angel acacio gcia de proyectos 2011

fesp faculdades raffael olÍmpio albuquerque...

como acercarse al cine gcia tsao

shane hartman – cissp, gcia, grem suncoast security...

post exploitation techniques on osx and iphone, eusecwest...

joseph raffael: moving towards the light june …joseph...

valvulas de control gcia mant

event graphs - eusecwest 2006

vasari | raffael · 2020. 1. 16. · wahrscheinlicher ist,...

hi 224 raffael scheck colby college (5). family...

gcia ambientes multiculturales empresas multiculturales

raffael\'s at the south shore country club

gcia transportes diplomado usb

eberhartinger, eva / speitmann, raffael / sureth-sloane,...