- There are tons of elements
and sources of security event information, right?
So here I'm actually showing a list
of the most common artifact elements found
in security events, right.
Now, source and destination IP addresses are usually shown
in network security events, right?
So here I'm actually showing the intrusion events panel
of the summary dashboard
of the Cisco FirePOWER Management Center or the FMC.
And here, you can actually see the top attackers
and the top IP targets or the top target IP addresses.
Now here, I'm actually showing a more detailed list
of events in the Cisco FMC showing the source
and destination IP addresses
of each system involved in each event, right?
So that's one of the beauties of the FMC is that
you know, of course you can actually drill down
through any events that you actually may see
and, you know, get more detailed information
you know, about those events, right, so.
Now here I'm actually showing something different, right?
So here I'm showing the Cisco ASA logs
in the Cisco Adaptive Security Device Manager or ASDM right.
So it's one of the legacy tools for the Cisco ASA
that you know, it can be used to configure
and also to monitor the specific Cisco ASA.
Now you can see that all the logs are actually mostly
around the five tuple concept, right?
So source destination, IP addresses,
source destination ports, and protocols.
Now services are also part of many security event logs.
Here, I'm actually showing
the Cisco ASDM firewall dashboard
and you can see statistics about the top services
and top destinations under attack, right.
Now, security threat intelligence is extremely useful
when correlating events and also for you to gain an insight
of what known threats are in your network.
Now here, you can actually see different security threat
intelligence events in the Cisco FMC, right?
And all this threat intelligence
is actually provided by Cisco
and specifically the Cisco Talos Research Organization.
Now, DNS intelligence and URL reputation
is also used in many security solutions
like the FirePOWER appliances, right.
It also is actually used in FirePOWER Threat Defense,
which is actually that combined image between the ASA
and the legacies of four plus more and also the Cisco web
and email security appliances as well.
Right? So then there's several other entities
within Cisco that actually, you know,
uses DNS intelligence and URL reputation as well.
Here I'm actually showing many security events
in the Cisco FMC that lists several communications
to non malicious command
and control servers, or what we call CNCs,
based on DNS intelligence.
Now file hashes are also part of many security event logs.
For example, the Cisco advanced malware protection
or AMP for networks and Cisco AMP for Endpoints,
they examine records and tracks, right?
And even send files to the Cloud
to actually know what is actually the disposition
of that file to see if actually
that file is actually malware.
So the Cisco AMP for network actually creates a SHA-256
hash of the file
and then it compares it to the local file cache.
Now, if the hash is actually not in the local cache,
then it queries the Cisco, you know, FMC.
And the Cisco FMC actually has its own cache
of all these hashes, you know
all the hashes that actually has seen before.
And if it actually hasn't seen that F hash or that file,
then it queries the Cloud, right?
So it queries the Cisco Cloud.
Now this a little bit different than AMP for Endpoints.
So AMP for Endpoints when a new,
when a file is actually new,
it can be analyzed locally
and doesn't have to be actually sent to the Cloud
for analysis, right?
Also the file is examined and stop in flight, right?
As it actually traverses the appliance
it is very important to note
that only the SHA-256 hash is actually sent
unless you actually configure a policy
to actually send the file for further analysis
and specifically to be sent to a sandbox.
And you know, this capability
for sandboxing is now a possible at Cisco because
of an acquisition of a company called Threat Grid, right?
That's just for your reference.
Now here I'm actually showing
the Cisco AMP for Endpoints console.
You can see a file
which is actually determined to be malware, right?
There you can actually see that SHA-256 hash
or the fingerprint of the actual file itself.
Now Cisco AMP can also provide retrospective analysis.
The Cisco AMP for networks appliance keeps data
from what actually occur in the past
and when a file this position is changed, the, you know
Cisco AMP provides a historical analysis
of what actually happens, right?
And also traces back the incident and the infection
you know, throughout the network and throughout the systems.
Now with the help of the Cisco AMP for Endpoints,
retrospection can actually reach out to that host
and then remediate the bad file even though
the file was actually permitted in the past, right?
So that's actually a beauty of the combination
of Cisco AMP for networks and Cisco AMP for Endpoints
to actually be able to do that type of remediation.
And this is a lot different
and a lot better than traditional antivirus
and even network antivirus technologies in the past, right?
Here I'm actually showing
the retrospective analysis capabilities
of the Cisco FirePOWER management console.
And you can actually see the network file trajectory
as I'm actually showing in here as well.
And to view this screen, you can just, you know,
navigate to analysis files, network file trajectory, right?
You can also access a file trajectory
from the actually context explorer dashboard
or event views in, you know, in,
within the file information, right?
So now you can also search
for a specific SHA-256 hash value.
You can also search by host IP addresses
or the name of a file that you actually want to track.
Now on the trajectory map,
you can locate the first time a file event occur
evolving an IP address, right?
This highlights a path to that data point
as well as any intervening, you know, file events
and IP addresses related to the first file event.
You can also click on any data point
to highlight a path that includes
all data points related to the selected path
or to the selected data point tracking
the actual file progress through the network, right?
Now another thing that you may have
to become familiar with is to actually parse data
and to perform incident analysis with regular expressions.
So again, for your reference,
if you're not familiar with the basic concepts
of regular expressions, I definitely, you know,
invite you to actually visit, you know,
these resources and I'm including just a few here.
There are many, many others, you know,
out in, of course, in the internet.
The first one here is actually the MIT's regex Cheat Sheet
which is actually, you know, fairly useful.
There's another, you know,
Regexp Security Cheat Sheet available in GitHub,
and also, you know, the third link actually
including some other information
about the regular expressions as well.