{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> je analytick\u00e9 \u0159e\u0161en\u00ed v oblasti kybernetick\u00e9 bezpe\u010dnosti, kter\u00e9 poskytuje komplexn\u00ed monitorov\u00e1n\u00ed hrozeb v distribuovan\u00e9 s\u00edti. Jeho fungov\u00e1n\u00ed je zalo\u017eeno na sb\u011bru NetFlow a IPFIX z router\u016f, p\u0159ep\u00edna\u010d\u016f a dal\u0161\u00edch s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed. D\u00edky tomu se s\u00ed\u0165 st\u00e1v\u00e1 citliv\u00fdm senzorem a umo\u017e\u0148uje administr\u00e1torovi nahl\u00e9dnout tam, kam se nedostanou tradi\u010dn\u00ed metody ochrany s\u00edt\u011b, jako je nap\u0159\u00edklad Firewall nov\u00e9 generace.<\/p>\n<p>V p\u0159edchoz\u00edch \u010dl\u00e1nc\u00edch jsem ji\u017e psal o StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prvn\u00ed p\u0159edstaven\u00ed a schopnosti<\/a><\/noindex>, a tak\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">nasazen\u00ed a konfigurace<\/a><\/noindex>. Nyn\u00ed navrhuji pokro\u010dit d\u00e1l a prodiskutovat, jak spr\u00e1vn\u011b pracovat s alarmy a vy\u0161et\u0159ovat bezpe\u010dnostn\u00ed incidenty, kter\u00e9 toto \u0159e\u0161en\u00ed generuje. Budou uvedeny 4 p\u0159\u00edklady, kter\u00e9, douf\u00e1m, poskytnou dobr\u00fd p\u0159ehled o u\u017eite\u010dnosti produktu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nNejprve je t\u0159eba \u0159\u00edct, \u017ee ve StealthWatch je ur\u010dit\u00e9 rozd\u011blen\u00ed ud\u00e1lost\u00ed na algoritmy a feedy. Prvn\u00ed jsou r\u016fzn\u00e9 alarmy (ozn\u00e1men\u00ed), p\u0159i jejich\u017e aktivaci lze odhalit podez\u0159el\u00e9 v\u011bci v s\u00edti. Druh\u00e9 jsou bezpe\u010dnostn\u00ed incidenty. V tomto \u010dl\u00e1nku bude diskutov\u00e1no o 4 p\u0159\u00edkladech aktivace algoritm\u016f a 2 p\u0159\u00edkladech feed\u016f.<\/p>\n<h2>1. Anal\u00fdza nejobjemn\u011bj\u0161\u00edch interakc\u00ed v s\u00edti<\/h2>\n<p>\nPrvn\u00edm krokem p\u0159i nastavov\u00e1n\u00ed StealthWatch je definice hostitel\u016f a s\u00edt\u00ed podle skupin. V webov\u00e9m rozhran\u00ed je z\u00e1lo\u017eka <i>Configure &gt; Host Group Management<\/i> , kde je t\u0159eba rozd\u011blit s\u00edt\u011b, hostitele a servery do odpov\u00eddaj\u00edc\u00edch skupin. Skupiny si lze tak\u00e9 vytv\u00e1\u0159et vlastn\u00ed. Mimochodem, anal\u00fdza interakc\u00ed mezi hostiteli v Cisco StealthWatch je velmi pohodln\u00e1, proto\u017ee lze nejen uchov\u00e1vat filtry vyhled\u00e1v\u00e1n\u00ed podle tok\u016f, ale tak\u00e9 samotn\u00e9 v\u00fdsledky.<\/p>\n<p>Nejprve je dobr\u00e9 se v webov\u00e9m rozhran\u00ed dostat na z\u00e1lo\u017eku <i>Analyze &gt; Flow Search<\/i>. N\u00e1sledn\u011b je t\u0159eba nastavit n\u00e1sleduj\u00edc\u00ed parametry:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (nejpopul\u00e1rn\u011bj\u0161\u00ed interakce)<\/li>\n<li>Time Range \u2014 24 hours (\u010dasov\u00fd \u00fasek, lze pou\u017e\u00edt jin\u00fd)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (jak\u00fdkoli srozumiteln\u00fd n\u00e1zev)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (zdroj \u2014 skupina vnit\u0159n\u00edch uzl\u016f)<\/li>\n<li>Connection (lze uv\u00e9st porty, aplikace)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (c\u00edlov\u00e1 skupina \u2014 skupina vnit\u0159n\u00edch uzl\u016f)<\/li>\n<li>V Advanced Options lze dodate\u010dn\u011b uv\u00e9st kolektor, ze kter\u00e9ho se data zobrazuj\u00ed, t\u0159\u00edd\u011bn\u00ed v\u00fdstupu (podle bajt\u016f, tok\u016f atd.). Nech\u00e1m to jako v\u00fdchoz\u00ed.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo stisknut\u00ed tla\u010d\u00edtka <i>Hledat <\/i>je vyd\u00e1n seznam interakc\u00ed, kter\u00e9 byly ji\u017e se\u0159azeny podle objemu p\u0159enesen\u00fdch dat.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV m\u00e9m p\u0159\u00edkladu hostitel <i>10.150.1.201<\/i> (server) v r\u00e1mci pouze jednoho vl\u00e1kna p\u0159edal<i> 1,5 GB<\/i> provoz na hostitele <i>10.150.1.200<\/i> (klientovi) pomoc\u00ed protokolu <i>mysql<\/i>. Tla\u010d\u00edtko <i>Spravovat sloupce<\/i> umo\u017e\u0148uje p\u0159idat v\u00edce sloupc\u016f do v\u00fdstupn\u00edch dat.<\/p>\n<p>Dal\u0161\u00ed na uv\u00e1\u017een\u00ed administr\u00e1tora je vytvo\u0159it vlastn\u00ed pravidlo, kter\u00e9 se bude spou\u0161t\u011bt neust\u00e1le na takov\u00e9 interakce a informovat p\u0159es SNMP, e-mail nebo Syslog. <\/p>\n<h2>2. Anal\u00fdza nejpomalej\u0161\u00edch klient-server interakc\u00ed v s\u00edti ohledn\u011b zpo\u017ed\u011bn\u00ed<\/h2>\n<p>\n\u0160t\u00edtky <b>SRT (Server Response Time)<\/b>, <b>RTT (Round Trip Time)<\/b> umo\u017e\u0148uj\u00ed zjistit zpo\u017ed\u011bn\u00ed server\u016f a celkov\u00e1 zpo\u017ed\u011bn\u00ed v s\u00edti. Tento n\u00e1stroj je obzvl\u00e1\u0161\u0165 u\u017eite\u010dn\u00fd, kdy\u017e je pot\u0159eba rychle naj\u00edt p\u0159\u00ed\u010dinu st\u00ed\u017enost\u00ed u\u017eivatel\u016f na pomalu funguj\u00edc\u00ed aplikaci.<\/p>\n<p><i>Pozn\u00e1mka<\/i>: prakticky v\u0161ichni Netflow export\u00e9\u0159i <b>neum\u011bj\u00ed<\/b> odes\u00edlat \u0161t\u00edtky SRT, RTT, proto je \u010dasto nutn\u00e9, aby vid\u011bli takov\u00e1 data na FlowSensor, nastavit odes\u00edl\u00e1n\u00ed kopie provozu z s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed. FlowSensor na druhou stranu poskytuje roz\u0161\u00ed\u0159en\u00fd IPFIX do FlowCollector.<\/p>\n<p>Tuto anal\u00fdzu je pohodln\u011bj\u0161\u00ed prov\u00e1d\u011bt v java aplikaci StealthWatch, kter\u00e1 se instaluje na po\u010d\u00edta\u010di administr\u00e1tora.<\/p>\n<p>Prav\u00fdm tla\u010d\u00edtkem my\u0161i na <i>Inside Hosts<\/i> a p\u0159ejd\u011bte na kartu <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlikn\u011bte na <i>Filtr <\/i>a nastavte pot\u0159ebn\u00e9 parametry. Jako p\u0159\u00edklad:<\/p>\n<ul>\n<li>Datum\/\u010cas \u2014 za posledn\u00ed 3 dny<\/li>\n<li>V\u00fdkon \u2014 Pr\u016fm\u011brn\u00fd Round Trip Time &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo vyveden\u00ed dat je t\u0159eba p\u0159idat zaj\u00edmav\u00e9 RTT, SRT pole. K tomu je t\u0159eba kliknout na sloupec na screenshotu a prav\u00fdm tla\u010d\u00edtkem vybrat <i>Spravovat sloupce<\/i>. D\u00e1le kliknout na parametry RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo zpracov\u00e1n\u00ed po\u017eadavku jsem se\u0159adil podle pr\u016fm\u011brn\u00e9ho RTT a uvid\u011bl nejpomalej\u0161\u00ed interakce.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAbych se dostal k podrobn\u00fdm informac\u00edm, je t\u0159eba kliknout prav\u00fdm tla\u010d\u00edtkem na tok a vybrat <i>Rychl\u00fd pohled na tok<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTyto informace ukazuj\u00ed, \u017ee hostitel <i>10.201.3.59<\/i> ze skupiny <i>Sales and Marketing<\/i> protokol, <i>NFS<\/i> se obrac\u00ed na <i>DNS server<\/i> po dobu jedn\u00e9 minuty a 23 sekund a m\u00e1 naprosto hrozn\u00e9 zpo\u017ed\u011bn\u00ed. Na kart\u011b <i>Interfaces <\/i>se m\u016f\u017eete dozv\u011bd\u011bt, z jak\u00e9ho Netflow export\u00e9ru byly data z\u00edsk\u00e1na. Na kart\u011b <i>Table <\/i> je uvedena podrobn\u011bj\u0161\u00ed informace o interakci.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le je t\u0159eba zjistit, kter\u00e1 za\u0159\u00edzen\u00ed odes\u00edlaj\u00ed provoz na FlowSensor a probl\u00e9m je pravd\u011bpodobn\u011b tam.<\/p>\n<p>Krom\u011b toho je StealthWatch unik\u00e1tn\u00ed t\u00edm, \u017ee prov\u00e1d\u00ed <b>deduplikaci<\/b> dat (spojuje stejn\u00e9 toky). Proto je mo\u017en\u00e9 shroma\u017e\u010fovat t\u00e9m\u011b\u0159 ze v\u0161ech za\u0159\u00edzen\u00ed Netflow a neb\u00e1t se, \u017ee bude mnoho duplicitn\u00edch dat. Naopak, v tomto sch\u00e9matu to pom\u016f\u017ee pochopit, na kter\u00e9m hopu jsou nejvy\u0161\u0161\u00ed zpo\u017ed\u011bn\u00ed.<\/p>\n<h2>3. Audit kryptografick\u00fdch protokol\u016f HTTPS<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> \u2014 technologie vyvinut\u00e1 spole\u010dnost\u00ed Cisco, kter\u00e1 umo\u017e\u0148uje detekovat zlovoln\u00e1 p\u0159ipojen\u00ed v \u0161ifrovan\u00e9m provozu bez jeho de\u0161ifrov\u00e1n\u00ed. Nav\u00edc tato technologie umo\u017e\u0148uje \"rozebrat\" HTTPS na verze TLS a kryptografick\u00e9 protokoly pou\u017e\u00edvan\u00e9 p\u0159i p\u0159ipojen\u00edch. Tato funkce je obzvl\u00e1\u0161\u0165 u\u017eite\u010dn\u00e1, kdy\u017e je t\u0159eba odhalit s\u00ed\u0165ov\u00e9 uzly, kter\u00e9 pou\u017e\u00edvaj\u00ed slab\u00e9 kryptostandardy.<\/p>\n<p><i>Pozn\u00e1mka<\/i>: p\u0159edt\u00edm je t\u0159eba nainstalovat aplikaci na StealthWatch \u2014 <b>ETA Audity Cryptografie<\/b>.<\/p>\n<p>P\u0159ejdeme na z\u00e1lo\u017eku <i>Dashboards \u2192 Eta Audity Cryptografie<\/i> a vybereme skupinu hostitel\u016f, kterou pl\u00e1nujeme analyzovat. Pro celkov\u00fd obraz zvol\u00edme <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017eeme pozorovat, \u017ee jsou vyps\u00e1na verze TLS a odpov\u00eddaj\u00edc\u00ed kryptostandard. Podle zn\u00e1m\u00e9ho sch\u00e9matu v sloupci <i>Akce <\/i>p\u0159ejdeme na <i>View Flows<\/i> a zah\u00e1j\u00ed se hled\u00e1n\u00ed v nov\u00e9m okn\u011b.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZ v\u00fdstupu je vid\u011bt, \u017ee hostitel <i>198.19.20.136<\/i> b\u011bhem <i>12 hodin<\/i> pou\u017e\u00edval HTTPS s TLS 1.2, kde \u0161ifrovac\u00ed algoritmus <i>AES-256<\/i> a hashovac\u00ed funkce <i>SHA-384<\/i>. Takto ETA umo\u017e\u0148uje naj\u00edt slab\u00e9 algoritmy v s\u00edti.<\/p>\n<h2>4. Anal\u00fdza anom\u00e1li\u00ed v s\u00edti<\/h2>\n<p>\nCisco StealthWatch dok\u00e1\u017ee rozpozn\u00e1vat anom\u00e1lie provozu v s\u00edti pomoc\u00ed t\u0159\u00ed n\u00e1stroj\u016f: <b>Core Events<\/b> (bezpe\u010dnostn\u00ed ud\u00e1losti), <b>Relationship Events<\/b> (ud\u00e1losti interakc\u00ed mezi segmenty, uzly s\u00edt\u011b) a <b>behavior\u00e1ln\u00ed anal\u00fdza<\/b>.<\/p>\n<p>Behavior\u00e1ln\u00ed anal\u00fdza pak umo\u017e\u0148uje v pr\u016fb\u011bhu \u010dasu vytvo\u0159it model chov\u00e1n\u00ed pro ur\u010dit\u00e9ho hostitele nebo skupinu hostitel\u016f. \u010c\u00edm v\u00edce provozu proch\u00e1z\u00ed StealthWatch, t\u00edm p\u0159esn\u011bj\u0161\u00ed budou vyvol\u00e1n\u00ed d\u00edky t\u00e9to anal\u00fdze. Na za\u010d\u00e1tku syst\u00e9m mnoho chybn\u00fdch spou\u0161t\u011bn\u00ed, tak\u017ee pravidla je t\u0159eba \"doladit\" ru\u010dn\u011b. Doporu\u010duji prvn\u00ed t\u00fddny nev\u011bnovat pozornost takov\u00fdm ud\u00e1lostem, proto\u017ee se syst\u00e9m s\u00e1m p\u0159izp\u016fsob\u00ed, nebo je p\u0159id\u00e1vat do v\u00fdjimek.<\/p>\n<p>N\u00ed\u017ee je uveden p\u0159\u00edklad p\u0159ednastaven\u00e9ho pravidla <i>Anomaly<\/i>, ve kter\u00e9m se uv\u00e1d\u00ed, \u017ee ud\u00e1lost se spust\u00ed bez alarmu, pokud <i>hostitelsk\u00fd po\u010d\u00edta\u010d ve skupin\u011b Inside Hosts interaguje se skupinou Inside Hosts a za 24 hodin provoz p\u0159ekro\u010d\u00ed 10 megabajt\u016f<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJako p\u0159\u00edklad vezmeme alarm <i>Hromad\u011bn\u00ed dat<\/i>, co\u017e znamen\u00e1, \u017ee n\u011bjak\u00fd hostitelsk\u00fd zdroj \/ ur\u010den\u00ed st\u00e1hl \/ nahr\u00e1l abnorm\u00e1ln\u011b velk\u00e9 mno\u017estv\u00ed dat z skupiny hostitel\u016f nebo hostitele. Klikn\u011bte na ud\u00e1lost a dostanete se do tabulky, kde jsou uvedeni spou\u0161t\u011bc\u00ed hostitel\u00e9. D\u00e1le si vybereme zaj\u00edmaj\u00edc\u00ed hostitele v sloupci <i>Hromad\u011bn\u00ed dat<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZobraz\u00ed se ud\u00e1lost, kter\u00e1 \u0159\u00edk\u00e1, \u017ee bylo detekov\u00e1no 162k \u201cbod\u016f\u201d, p\u0159i\u010dem\u017e podle politiky je povoleno 100k \u201cbod\u016f\u201d \u2014 to jsou intern\u00ed metriky StealthWatch. V sloupci <i>Akce <\/i>klikn\u011bte <i>View Flows<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017eeme pozorovat, \u017ee <i>tento hostitel<\/i> v noci interagoval s hostitelem <i>10.201.3.47<\/i> z odd\u011blen\u00ed <i>Prodej a marketing<\/i> protokol, <i>HTTPS <\/i>a st\u00e1hl <i>1,4 GB<\/i>. Mo\u017en\u00e1, \u017ee tento p\u0159\u00edklad nen\u00ed \u00fapln\u011b ide\u00e1ln\u00ed, ale detekce interakc\u00ed a na n\u011bkolik stovek gigabajt\u016f prob\u00edh\u00e1 p\u0159esn\u011b stejn\u00fdm zp\u016fsobem. N\u00e1sledn\u011b m\u016f\u017ee dal\u0161\u00ed vy\u0161et\u0159ov\u00e1n\u00ed anom\u00e1li\u00ed p\u0159in\u00e9st zaj\u00edmav\u00e9 v\u00fdsledky.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Pozn\u00e1mka<\/i>: v webov\u00e9m rozhran\u00ed SMC se data na kart\u00e1ch <i>N\u00e1st\u011bnky <\/i>zobrazuj\u00ed pouze za posledn\u00ed t\u00fdden a na kart\u011b <i>Monitor<\/i> za posledn\u00ed 2 t\u00fddny. Pro anal\u00fdzu star\u0161\u00edch ud\u00e1lost\u00ed a generov\u00e1n\u00ed zpr\u00e1v je t\u0159eba pracovat s java konzol\u00ed na po\u010d\u00edta\u010di administr\u00e1tora.<\/p>\n<h2>5. Vyhled\u00e1v\u00e1n\u00ed intern\u00edch skener\u016f s\u00edt\u011b<\/h2>\n<p>\nNyn\u00ed si uk\u00e1\u017eeme n\u011bkolik p\u0159\u00edklad\u016f krmiv \u2014 incident\u016f IB. Tato funkce je zaj\u00edmav\u011bj\u0161\u00ed pro bezpe\u010dnostn\u00ed pracovn\u00edky.<\/p>\n<p>P\u0159edinstalovan\u00e9 typy ud\u00e1lost\u00ed skenov\u00e1n\u00ed v StealthWatch jsou r\u016fzn\u00e9:<\/p>\n<ul>\n<li>Skenov\u00e1n\u00ed portu \u2014 zdroj skenuje mno\u017estv\u00ed port\u016f c\u00edlov\u00e9ho uzlu.<\/li>\n<li>Addr tcp sken \u2014 zdroj skenuje celou s\u00ed\u0165 podle stejn\u00e9ho TCP portu, p\u0159i\u010dem\u017e m\u011bn\u00ed IP adresu ur\u010den\u00ed. P\u0159itom zdroj dost\u00e1v\u00e1 TCP Reset pakety nebo naopak neobdr\u017e\u00ed \u017e\u00e1dn\u00e9 odpov\u011bdi.<\/li>\n<li>Addr udp sken \u2014 zdroj skenuje celou s\u00ed\u0165 podle stejn\u00e9ho UDP portu, p\u0159i\u010dem\u017e m\u011bn\u00ed IP adresu ur\u010den\u00ed. P\u0159itom zdroj dost\u00e1v\u00e1 ICMP Port Unreachable pakety nebo neobdr\u017e\u00ed \u017e\u00e1dn\u00e9 odpov\u011bdi.<\/li>\n<li>Ping sken \u2014 zdroj pos\u00edl\u00e1 ICMP \u017e\u00e1dosti do cel\u00e9 s\u00edt\u011b s c\u00edlem vyhledat odpov\u011bdi.<\/li>\n<li>Stealth sken tcp \/ udp \u2014 zdroj pou\u017e\u00edval stejn\u00fd sv\u016fj port pro p\u0159ipojen\u00ed k mnoha port\u016fm na c\u00edlov\u00e9m uzlu ve stejnou dobu.<\/li>\n<\/ul>\n<p>\nPro snadn\u011bj\u0161\u00ed vyhled\u00e1n\u00ed v\u0161ech intern\u00edch skener\u016f existuje s\u00ed\u0165ov\u00e1 aplikace pro <i>StealthWatch \u2014 Hodnocen\u00ed viditelnosti<\/i>. Po kliknut\u00ed na kartu <i>N\u00e1st\u011bnky \u2192 Hodnocen\u00ed viditelnosti \u2192 Intern\u00ed skenery s\u00edt\u011b<\/i> uvid\u00edte bezpe\u010dnostn\u00ed incidenty t\u00fdkaj\u00edc\u00ed se skenov\u00e1n\u00ed za posledn\u00ed 2 t\u00fddny.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKliknut\u00edm na tla\u010d\u00edtko <i>Podrobnosti<\/i>, bude vid\u011bt za\u010d\u00e1tek skenov\u00e1n\u00ed ka\u017ed\u00e9 s\u00edt\u011b, trend provozu a odpov\u00eddaj\u00edc\u00ed alarmy.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le se m\u016f\u017eete \u201eprohloubit\u201c na hostitele z karty na p\u0159edchoz\u00edm sn\u00edmku a zobrazit bezpe\u010dnostn\u00ed ud\u00e1losti a tak\u00e9 aktivitu za posledn\u00ed t\u00fdden pro tento hostitel.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJako p\u0159\u00edklad se pod\u00edv\u00e1me na ud\u00e1lost <i>Skener port\u016f<\/i> z hostitele <i>10.201.3.149<\/i> na <i>10.201.0.72<\/i>, kliknut\u00edm na <i>Akce &gt; Souvisej\u00edc\u00ed toky<\/i>. Spust\u00ed se hled\u00e1n\u00ed podle tok\u016f a zobraz\u00ed se relevantn\u00ed informace.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak vid\u00edme, tento hostitel z jednoho sv\u00e9ho portu <i>51508\/TCP<\/i> skanoval p\u0159ed 3 hodinami c\u00edlov\u00fd hostitel na portech<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. N\u011bkter\u00e1 pole nezobrazuj\u00ed informace, bu\u010f proto, \u017ee ne v\u0161echna pole Netflow jsou podporov\u00e1na na Netflow export\u00e9ru.<\/p>\n<h2>6. Anal\u00fdza sta\u017een\u00fdch malware pomoc\u00ed CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 cloudov\u00e1 analytika Cisco, kter\u00e1 se skv\u011ble integruje s Cisco StealthWatch a umo\u017e\u0148uje doplnit bezsigne\u010dn\u00ed anal\u00fdzu signaturou. T\u00edm se st\u00e1v\u00e1 mo\u017en\u00e9 detekov\u00e1n\u00ed trojan\u016f, s\u00ed\u0165ov\u00fdch \u010derv\u016f, malware nult\u00e9ho dne a dal\u0161\u00edch zlovoln\u00fdch software a jejich \u0161\u00ed\u0159en\u00ed v r\u00e1mci s\u00edt\u011b. Tak\u00e9 d\u0159\u00edve zm\u00edn\u011bn\u00e1 technologie ETA umo\u017e\u0148uje analyzovat takov\u00e9 zlovoln\u00e9 komunikace i v \u0161ifrovan\u00e9m provozu.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u0159ka na prvn\u00ed kart\u011b ve webov\u00e9m rozhran\u00ed je speci\u00e1ln\u00ed widget <i>Cognitive Threat Analytics<\/i>. Stru\u010dn\u00fd p\u0159ehled informuje o detekovan\u00fdch hrozb\u00e1ch na u\u017eivatelsk\u00fdch hostitel\u00edch: trojan, podvodn\u00fd software, ru\u0161iv\u00e9 reklamn\u00ed software. Slovo \u201eEncrypted\u201c pr\u00e1v\u011b sv\u011bd\u010d\u00ed o pr\u00e1ci ETA. Kliknut\u00edm na hostitele se zobraz\u00ed v\u0161echny informace, v\u010detn\u011b bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed, log\u016f ze CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159i najet\u00ed na ka\u017edou etapu CTA se zobrazuje podrobn\u00e1 informace o interakci. Pro plnou anal\u00fdzu je dobr\u00e9 kliknout na <i>Zobrazit podrobnosti incidentu<\/i>, a dostanete se do samostatn\u00e9 konzole. <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV prav\u00e9m horn\u00edm rohu filtr umo\u017e\u0148uje zobrazit ud\u00e1losti podle \u00farovn\u011b z\u00e1va\u017enosti. P\u0159i najet\u00ed na konkr\u00e9tn\u00ed anom\u00e1lii se ve spodn\u00ed \u010d\u00e1sti obrazovky zobrazuj\u00ed logy s odpov\u00eddaj\u00edc\u00edm \u010dasov\u00fdm r\u00e1mcem vpravo. T\u00edmto zp\u016fsobem specialist\u00e9 na kybernetickou bezpe\u010dnost jasn\u011b ch\u00e1pou, kter\u00fd infikovan\u00fd hostitel po jak\u00fdch akc\u00edch za\u010dal prov\u00e1d\u011bt jak\u00e9 akce.<\/p>\n<p>N\u00ed\u017ee je zobrazen dal\u0161\u00ed p\u0159\u00edklad \u2014 bankovn\u00ed trojan, kter\u00fdm byl hostitel infikov\u00e1n <i>198.19.30.36<\/i>. Tento hostitel za\u010dal interagovat se zlovoln\u00fdmi dom\u00e9nami a v log\u00e1ch je zobrazen\u00e1 informace o toc\u00edch t\u011bchto interakc\u00ed. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le jedno z nejlep\u0161\u00edch \u0159e\u0161en\u00ed, jak\u00e9 m\u016f\u017ee b\u00fdt, je um\u00edstit hostitele do karant\u00e9ny d\u00edky nativn\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integrace <\/a><\/noindex>s Cisco ISE pro dal\u0161\u00ed l\u00e9\u010dbu a anal\u00fdzu. <\/p>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\n\u0158e\u0161en\u00ed Cisco StealthWatch pat\u0159\u00ed mezi l\u00eddry v oblasti monitorov\u00e1n\u00ed s\u00edt\u00ed, a to jak z hlediska anal\u00fdzy s\u00edt\u011b, tak informa\u010dn\u00ed bezpe\u010dnosti. D\u00edky n\u011bmu m\u016f\u017eete odhalit nelegitimn\u00ed interakce v r\u00e1mci s\u00edt\u011b, zpo\u017ed\u011bn\u00ed aplikac\u00ed, nejaktivn\u011bj\u0161\u00ed u\u017eivatele, anom\u00e1lie, malware a APT. Nav\u00edc dok\u00e1\u017ee identifikovat skenov\u00e1n\u00ed, pentestery a prov\u00e1d\u011bt kryptoaudit HTTPS provozu. Je\u0161t\u011b v\u00edce p\u0159\u00edpad\u016f pou\u017eit\u00ed najdete na <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">odkazu<\/a><\/noindex>.<\/p>\n<p>Pokud m\u00e1te chu\u0165 ov\u011b\u0159it, jak hladce a efektivn\u011b funguje va\u0161e s\u00ed\u0165, ode\u0161lete <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">\u017e\u00e1dost<\/a><\/noindex>. <br \/>\nV nejbli\u017e\u0161\u00ed dob\u011b pl\u00e1nujeme n\u011bkolik dal\u0161\u00edch technick\u00fdch publikac\u00ed o r\u016fzn\u00fdch produktech IB. Pokud v\u00e1s toto t\u00e9ma zaj\u00edm\u00e1, sledujte aktualizace na na\u0161ich kan\u00e1lech (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: anal\u00fdza a vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f. \u010c\u00e1st 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}