{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> on anal\u00fc\u00fcsilahendus, mis pakub laialdast ohtude j\u00e4lgimist jaotatud v\u00f5rgus. StealthWatch t\u00f6\u00f6p\u00f5him\u00f5te p\u00f5hineb NetFlow ja IPFIX kogumisel marsruutereilt, l\u00fclititest ja teistelt v\u00f5rgu seadmetelt. Selle tulemusena muutub v\u00f5rk tundlikuks sensoriks, mis v\u00f5imaldab administraatoril n\u00e4ha kohti, kuhu ei p\u00e4\u00e4se traditsioonilised v\u00f5rgu kaitsemeetodid, nagu n\u00e4iteks Next Generation Firewall.<\/p>\n<p>Eelmistes artiklites olen juba kirjutanud StealthWatch'ist: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">esimene tutvustus ja v\u00f5imalused<\/a><\/noindex>, samuti <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">paigaldamine ja seadistamine<\/a><\/noindex>. Praegu pakun edasi liikuda ja arutada, kuidas tuleks t\u00f6\u00f6tada alarmide ja uurida turvaintsidente, mida lahendus genereerib. Toome v\u00e4lja 6 n\u00e4idet, mis loodetavasti annavad hea \u00fclevaate toote kasulikkusest.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nEsmaltame tuleks \u00f6elda, et StealthWatch'is on mingi jaotumine signaalide ja voogude vahel. Esimesed on erinevad alarmid (teavitused), mille aktiveerimisel on v\u00f5imalik tuvastada kahtlasi asju v\u00f5rgus. Teised on turvainfektsioonid. K\u00e4esolevas artiklis k\u00e4sitletakse 4 n\u00e4idet algoritmide aktiveerimistest ja 2 n\u00e4idet vooge.<\/p>\n<h2>1. V\u00f5rgus k\u00f5ige mahtude anal\u00fc\u00fcs<\/h2>\n<p>\nStealthWatch'i seadistamise esimene samm on hostide ja v\u00f5rkude m\u00e4\u00e4ratlemine r\u00fchmade kaupa. Veebiliidese sakk <i>Configure &gt; Host Group Management<\/i> tuleb jagada v\u00f5rgud, hostid ja serverid vastavatesse r\u00fchmadesse. R\u00fchmi on v\u00f5imalik luua ka ise. Muide, hostide vahelise suhtluse anal\u00fc\u00fcs Cisco StealthWatch'is on \u00fcsna mugav, kuna on v\u00f5imalik mitte ainult salvestada otsingufiltreid voogude j\u00e4rgi, vaid ka ise tulemusi.<\/p>\n<p>Alustuseks tuleks veebiliideses minna sakkadesse <i>Analyze &gt; Flow Search<\/i>. Seej\u00e4rel tuleks seada j\u00e4rgmised parameetrid:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (populaarseimad suhtlused)<\/li>\n<li>Time Range \u2014 24 hours (ajavahemik, v\u00f5ib kasutada ka muud)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (\u00fcksk\u00f5ik milline m\u00f5istetav nimi)<\/li>\n<li>Teema \u2014 Host Groups \u2192 Inside Hosts (allikas \u2014 sise s\u00f5lmede grupp)<\/li>\n<li>\u00dchendus (v\u00f5ib m\u00e4\u00e4rata portid, rakendused)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (sihtkoht \u2014 sise s\u00f5lmede grupp)<\/li>\n<li>Advanced Options'is saab lisada ka kollektsiooni, millest andmeid vaadata, v\u00e4ljundi sortimise (baidid, vood ja muu). J\u00e4tan vaikimisi.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast nupu vajutamist <i>Otsi <\/i>antakse v\u00e4lja juba sorteeritud interaktsioonide nimekiri, mis on j\u00e4rjestatud edastatud andmete hulga j\u00e4rgi.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMinu n\u00e4ites edastas host <i>10.150.1.201<\/i> (server) ainult \u00fche voo piires<i> 1,5 GB<\/i> liiklust hostile <i>10.150.1.200<\/i> (klient) protokolli kaudu <i>mysql<\/i>. Nupp <i>Administreeri veerge<\/i> lubab lisada rohkem veerge v\u00e4ljundandmetesse.<\/p>\n<p>Edasi, administraatori \u00e4ran\u00e4gemisel saab luua kohandatud reegli, mis t\u00f6\u00f6tab pidevalt selle t\u00fc\u00fcpi interaktsioonide jaoks ja teavitab l\u00e4bi SNMP, e-posti v\u00f5i Syslog. <\/p>\n<h2>2. Anal\u00fc\u00fcsige v\u00f5rgus k\u00f5ige aeglasemaid kliendi-serveri interaktsioone viivituste osas<\/h2>\n<p>\nM\u00e4rgid <b>SRT (Server Response Time)<\/b>, <b>RTT (Round Trip Time)<\/b> aitavad tuvastada serverite ja kogu v\u00f5rgu viivitusi. See t\u00f6\u00f6riist on eriti mugav, kui tuleb kiiresti leida p\u00f5hjus, miks kasutajad kurdavad aeglaselt t\u00f6\u00f6tava rakenduse \u00fcle.<\/p>\n<p><i>M\u00e4rkus<\/i>: praktiliselt k\u00f5ik Netflow eksportijad <b>ei oska<\/b> SRT ja RTT silte saatmiseks tuleb tihti seadistada liikluskoopia saatmine v\u00f5rguseadmest, et n\u00e4ha selliseid andmeid FlowSensoris. FlowSensor omakorda edastab laiendatud IPFIX-i FlowCollectorile.<\/p>\n<p>Sellist anal\u00fc\u00fctikat on mugavam teostada Java rakenduses StealtWatch, mille saab installida administraatori arvutisse.<\/p>\n<p>Paremkl\u00f5ps <i>Inside Hosts<\/i> ja liigume vahekaardile <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKl\u00f5psame <i>Filtreerimine <\/i>ja m\u00e4\u00e4rame vajalikud parameetrid. N\u00e4iteks:<\/p>\n<ul>\n<li>Kuup\u00e4ev\/aeg \u2014 Viimase 3 p\u00e4eva jooksul<\/li>\n<li>T\u00f5husus \u2014 Keskmine \u00fcmbermineku aeg &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAndmete kuvamise j\u00e4rel tuleb lisada huvipakkuvad RTT ja SRT v\u00e4ljad. Selleks kl\u00f5psake ekraanipildil olevat veergu ning paremkl\u00f5psates valige <i>Administreeri veerge<\/i>. Edasi kl\u00f5psake RTT ja SRT parameetrite peal.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast p\u00e4ringu t\u00f6\u00f6tlemist sorteerisin andmeid keskmise RTT j\u00e4rgi ja n\u00e4gin aeglasemaid interaktsioone.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuna soovite rohkemate detailide juurde s\u00fcveneda, peate paremkl\u00f5psama voolule ja valima <i>Quick View for Flow<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSee teave n\u00e4itab, et host <i>10.201.3.59<\/i> r\u00fchmast <i>Sales and Marketing<\/i> protokolli kaudu <i>NFS<\/i> viitab <i>DNS-serveriga<\/i> \u00fche minuti ja 23 sekundi jooksul ning tal on kohutav viivitus. Vahekaardil <i>Interfaces <\/i>v\u00f5ib teada, milliselt Netflow eksportijalt andmed on saadud. Vahekaardil <i>Tabela <\/i> on esitatud \u00fcksikasjalikum teave suhtlemise kohta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4rgmiseks on oluline v\u00e4lja selgitada, millised seadmed saadavad liiklust FlowSensorisse ja probleem t\u00f5en\u00e4oliselt peitub seal.<\/p>\n<p>Lisaks on StealthWatch ainulaadne, kuna see viib l\u00e4bi <b>deduplikatsiooni<\/b> andmete (\u00fchendab samad vood). Seet\u00f5ttu on v\u00f5imalik koguda andmeid praktiliselt k\u00f5igilt Netflow seadmetelt ja mitte muretseda korduvate andmete \u00fcle. Just vastupidi, see skeem aitab m\u00f5ista, kus on suurimad viivitused.<\/p>\n<h2>3. Kr\u00fcptograafiliste protokollide auditeerimine HTTPS<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> on Cisco poolt v\u00e4lja t\u00f6\u00f6tatud tehnoloogia, mis v\u00f5imaldab avastada pahatahtlikke \u00fchendusi kr\u00fcpteeritud liikluses ilma selle dekr\u00fcpteerimiseta. Lisaks v\u00f5imaldab see tehnoloogia anal\u00fc\u00fcsida HTTPS-i TLS versioone ja kr\u00fcptograafilisi protokolle, mida \u00fchendustes kasutatakse. See funktsionaalsus on eriti kasulik, kui on vajalik tuvastada v\u00f5rgu s\u00f5lmede kasutamine n\u00f5rkade kr\u00fcpto standarditega.<\/p>\n<p><i>M\u00e4rkus<\/i>: eelnevalt tuleb StealthWatchile installida network app \u2014 <b>ETA kr\u00fcptograafiline audit<\/b>.<\/p>\n<p>L\u00e4heme vahekaardile <i>Dashboards \u2192 ETA kr\u00fcptograafiline audit<\/i> ja valime hostide r\u00fchma, mida plaanitakse anal\u00fc\u00fcsida. \u00dcldise \u00fclevaate saamiseks valime <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOn n\u00e4ha, et kuvatakse TLS-i versioon ja vastav kr\u00fcptostandard. Harjumusp\u00e4rasel viisil veerus <i>Tegevused <\/i>liigume <i>Vaata vooge<\/i> ja otsing k\u00e4ivitub uues vahekaardis.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00e4ljundist on n\u00e4ha, et host <i>198.19.20.136<\/i> on kasutanud <i>12 tundi<\/i> HTTPS-i koos TLS 1.2-ga, kus kr\u00fcptimisalgoritm <i>AES-256<\/i> ja r\u00e4sifunktsioon <i>SHA-384<\/i>. Seega v\u00f5imaldab ETA leida v\u00f5rgu n\u00f5rku algoritme.<\/p>\n<h2>4. Anomaaliate anal\u00fc\u00fcs v\u00f5rgus<\/h2>\n<p>\nCisco StealthWatch suudab tuvastada v\u00f5rgu liikluse anomaaliaid, kasutades kolme t\u00f6\u00f6riista: <b>Tuuma s\u00fcndmused<\/b> (turvas\u00fcndmused), <b>Suhete s\u00fcndmused<\/b> (s\u00fcndmused segmente, v\u00f5rgus olevate nodide vahel) ja <b>k\u00e4itumuslik anal\u00fc\u00fcs<\/b>.<\/p>\n<p>K\u00e4itumuslik anal\u00fc\u00fcs, omakorda, v\u00f5imaldab ajas luua k\u00e4itumismudeli teatud hosti v\u00f5i hostide gruppe jaoks. Mida rohkem liiklust l\u00e4bib StealthWatch, seda t\u00e4psemad on selle anal\u00fc\u00fcsi p\u00f5hjal genereeritud avastused. Alguses aktiveerib s\u00fcsteem palju valealarmen, seega peaks reegleid k\u00e4sitsi \u201et\u00fckkideks\u201c reguleerima. Soovitan esimesed paar n\u00e4dalat sellistel s\u00fcndmustel mitte t\u00e4helepanu p\u00f6\u00f6rata, kuna s\u00fcsteem kohandub iseseisvalt, v\u00f5i lisada need eranditesse.<\/p>\n<p>Allpool on toodud n\u00e4ide eelkonfigureeritud reeglist <i>Anomaly<\/i>, mis \u00fctleb, et s\u00fcndmus aktiveeritakse ilma alarmita, kui <i>host r\u00fchmas Inside Hosts suhtleb r\u00fchmaga Inside Hosts ja 24 tunni jooksul \u00fcletab liiklus 10 megabaiti<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuna n\u00e4idis, v\u00f5tame alarmi <i>Data Hoarding<\/i>, mis t\u00e4hendab, et m\u00f5ni host allikast\/sihtkohast on alusetult suuri andmemahtusid r\u00fchmast hostidest v\u00f5i hostilt \u00fcles laadinud\/allalaadinud. Klikkime s\u00fcndmusel ja suundume tabelisse, kus on esitatud aktiveerivad hostid. Seej\u00e4rel valime meid huvitava hosti veerust. <i>Data Hoarding<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuvatakse s\u00fcndmus, mis \u00fctleb, et avastati 162k \u201epunkti\u201c, samas kui poliitika lubab 100k \u201epunkti\u201c \u2014 need on StealthWatchi sisemised m\u00f5\u00f5dikud. Veerus <i>Tegevused <\/i>vajutame <i>Vaata vooge<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMe v\u00f5ime m\u00e4rgata, et <i>see host<\/i> \u00f6\u00f6siti suhtles hostiga <i>10.201.3.47<\/i> osakonnast <i>M\u00fc\u00fck ja turundus<\/i> protokolli kaudu <i>HTTPS <\/i>ja allalaaditi <i>1,4 GB<\/i>. See n\u00e4ide v\u00f5ib olla mitte k\u00f5ige \u00f5nnestunum, kuid interaktsioonide tuvastamine isegi mitme sajandi gigabaidi ulatuses toimub sama meetodiga. Seega v\u00f5ib edasine anomaaliate uurimine anda huvitavaid tulemusi.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>M\u00e4rkus<\/i>: SMC veebiliideses kuvatakse andmed sakkides <i>T\u00f6\u00f6pink <\/i>ainult viimase n\u00e4dala kohta ja sakis <i>Monitor<\/i> viimase kahe n\u00e4dala kohta. Vanemate s\u00fcndmuste anal\u00fc\u00fcsimiseks ja aruannete genereerimiseks tuleb t\u00f6\u00f6tada administraatori arvuti java-konsoolis.<\/p>\n<h2>5. Sisemiste v\u00f5rgu skaneerimiste leidmine<\/h2>\n<p>\nN\u00fc\u00fcd vaatame m\u00f5ningaid fiede \u2014 IB juhtumeid. See funktsionaalsus on rohkem huvitav turvameestele.<\/p>\n<p>StealthWatchis on mitmeid eeldefineeritud skaneerimise s\u00fcndmuste t\u00fc\u00fcpe:<\/p>\n<ul>\n<li>Port Scan \u2014 allikas skaneerib sihtr\u00fchma palju porte.<\/li>\n<li>Addr tcp skannimine \u2014 allikas skaneerib terve v\u00f5rgu \u00fche ja sama TCP p\u00f5hja kaudu, muutes seejuures siht-IP-aadressi. Samuti saadab allikas TCP Reset pakette v\u00f5i ei saa vastuseid \u00fcldse.<\/li>\n<li>Addr udp skannimine \u2014 allikas skaneerib terve v\u00f5rgu \u00fche ja sama UDP p\u00f5hja kaudu, muutes seejuures siht-IP-aadressi. Samuti saadab allikas ICMP Port Unreachable pakette v\u00f5i ei saa vastuseid \u00fcldse.<\/li>\n<li>Ping skannimine \u2014 allikas saadab ICMP p\u00e4ringuid tervele v\u00f5rgule, et leida vastuseid.<\/li>\n<li>Stealth skannimine tcp\/udp \u2014 allikas kasutas sama porti, et \u00fchendada mitme pordi kaudu sihtpunktis korraga.<\/li>\n<\/ul>\n<p>\nKergema juurdep\u00e4\u00e4su jaoks k\u00f5igile sisemistele skanneritele on olemas v\u00f5rgu rakendus: <i>StealthWatch \u2014 n\u00e4htavuse hindamine<\/i>. Minna vahekaardile <i>Armatuurlaud \u2192 N\u00e4htavuse hindamine \u2192 Sisemised v\u00f5rgu skannerid<\/i> n\u00e4ete skannimisega seotud turva\u00f5nnetusi viimase 2 n\u00e4dala jooksul.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKliki nupule <i>Details<\/i>, on n\u00e4ha skaneerimise algus igas v\u00f5rgus, liiklustrend ja vastavad alarmid.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEdasi on v\u00f5imalik 'sukelduda' hosti, kasutades eelnevalt n\u00e4idatud vahekaarti, ja vaadata turvas\u00fcndmusi ning tegevust viimase n\u00e4dala jooksul selle hosti jaoks.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e4iteks anal\u00fc\u00fcsime s\u00fcndmust <i>Port Scan<\/i> hostilt <i>10.201.3.149<\/i> j\u00e4rgnevaga <i>10.201.0.72<\/i>, klikkides <i>Toimingud &gt; Seotud Voogud<\/i>. Algab voogude otsing ja kuvatakse asjakohane teave.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuidas me n\u00e4eme, et see host skaneeris \u00fche oma pordi <i>51508\/TCP<\/i> 3 tundi tagasi sihthosti portsid<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. M\u00f5ned v\u00e4ljad ei kuva teavet, kas v\u00f5i sellep\u00e4rast, et k\u00f5ik Netflow v\u00e4ljad ei ole Netflow eksportijaga \u00fchilduvad.<\/p>\n<h2>6. Allalaaditud pahavara anal\u00fc\u00fcs CTA abil<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 Cisco pilveanal\u00fc\u00fctika, mis integreerub suurep\u00e4raselt Cisco StealthWatchiga ja v\u00f5imaldab t\u00e4iendada allkirjade anal\u00fc\u00fcsi allkirjatu anal\u00fc\u00fcsiga. Seel\u00e4bi on v\u00f5imalik tuvastada troojaneid, v\u00f5rguussid, null-p\u00e4eva pahavara ja muud pahatahtlikku tegevust ning nende levikut v\u00f5rgus. Samuti v\u00f5imaldab eelnevalt mainitud tehnoloogia ETA anal\u00fc\u00fcsida selliseid pahatahtlikke suhtlusi ka kr\u00fcpteeritud liikluses.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTegelikult on esimese vahekaardiga veebiliideses spetsiaalne vidin <i>Cognitive Threat Analytics<\/i>. \u00dclevaade r\u00e4\u00e4gib avastatud ohtudest kasutajate hostides: trooja, petuskeemid, pealet\u00fckkiv reklaamvara. S\u00f5na \u201cEncrypted\u201d t\u00f5estab ETA t\u00f6\u00f6d. Klikkides hostile, ilmub kogu teave, sealhulgas turvas\u00fcndmuste logid CSTA kohta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00e4ies \u00fcle iga CSTA etapi, kuvatakse koost\u00f6\u00f6 kohta \u00fcksikasjalik teave. T\u00e4iendava anal\u00fc\u00fcsi jaoks vajutage <i>Vaata juhtumi detaile<\/i>, ja te j\u00f5uate eraldi konsooli <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nParemas \u00fclanurgas asuv filter v\u00f5imaldab kuvada s\u00fcndmusi kriitilisuse taseme j\u00e4rgi. Konkreetse anomaalia kohal liikudes ilmuvad ekraani alumises osas logid vastava ajaskaalaga paremal. Sel viisil m\u00f5istab infotehnoloogia spetsialist selgelt, milline nakatunud host hakkas p\u00e4rast teatud toimingute tegemist mingeid tegevusi t\u00e4itma.<\/p>\n<p>Allpool on esitatud veel \u00fcks n\u00e4ide \u2014 pangatrooja, millega host nakatunud <i>198.19.30.36<\/i>. Antud host hakkas suhtlema pahatahtlike domeenidega, ning logides on n\u00e4idatud teavet nende suhtluste voogude kohta. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja juhtumite uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEdasi on \u00fcks parimaid lahendusi, mis v\u00f5ib olla \u2014 panna host karantiini t\u00e4nu natiivsele <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integreerimise <\/a><\/noindex>Cisco ISE ab v\u00e4ljat\u00f6\u00f6tamiseks ja anal\u00fc\u00fcsiks. <\/p>\n<h2>Kokkuv\u00f5te<\/h2>\n<p>\nCisco StealthWatch on \u00fcks juhtivaid tooteid v\u00f5rgu j\u00e4lgimise valdkonnas nii v\u00f5rguanal\u00fc\u00fcsi kui ka infotehnoloogia turbek\u00fcsimustes. Selle abil saab avastada ebaseaduslikke liigiseid v\u00f5rgu sees, rakenduse viivitusi, k\u00f5ige aktiivsemaid kasutajaid, anomaaliaid, pahavara ja APT. Lisaks on v\u00f5imalik tuvastada skannimisi, pentestimise teostajaid ning teostada HTTPS liikluse kr\u00fcptoauditit. Veel rohkem kasutusjuhtumeid leiate siit <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">lingi kaudu<\/a><\/noindex>.<\/p>\n<p>Kui soovite kontrollida, kui sujuvalt ja efektiivselt teie v\u00f5rgus k\u00f5ik t\u00f6\u00f6tab, saatke <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">taotlus<\/a><\/noindex>. <br \/>\nJ\u00e4rgmise paari n\u00e4dala jooksul plaanime veel mitu tehnilist v\u00e4ljaannet erinevate IT turbe tootenimekirjade kohta. Kui teid huvitab see teema, siis j\u00e4lgige meie kanalite v\u00e4rskendusi (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: anal\u00fc\u00fcs ja s\u00fcndmuste uurimine. Osa 3 | ProHoster","description":"Cisco StealthWatch on anal\u00fc\u00fcsilahendus k\u00fcberturbe valdkonnas, mis tagab p\u00f5hjaliku ohtude j\u00e4lgimise hajutatud v\u00f5rgus. StealthWatchi t\u00f6\u00f6 aluseks on NetFlow ja IPFIXi kogumine ruuteritest, l\u00fclititest ja muudest v\u00f5rguseadmetest. Tulemuseks on v\u00f5rk, mis muutub tundlikuks sensoriks ja v\u00f5imaldab administraatoril n\u00e4ha kohti, kuhu traditsioonilised v\u00f5rgu kaitsemeetodid, n\u00e4iteks j\u00e4rgmise p\u00f5lvkonna lahendused, ei ulatu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:description":"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}