{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> on anal\u00fc\u00fctiline lahendus IT-ohutuses, mis tagab tervikliku ohu j\u00e4lgimise hajutatud v\u00f5rgus. StealthWatch p\u00f5hineb NetFlow ja IPFIX kogumisel ruuteritest, l\u00fclititest ja muudest v\u00f5rguseadmetest. Selle tulemusena muutub v\u00f5rk tundlikuks sensoriks ja v\u00f5imaldab administraatoril vaadata sinna, kuhu traditsioonilised v\u00f5rgu kaitsemeetodid, nagu j\u00e4rgmise p\u00f5lvkonna tulem\u00fc\u00fcr, ei p\u00e4\u00e4se.<\/p>\n<p>Olen varasemates artiklites juba kirjutanud StealthWatchist: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">esimene esitlemine ja v\u00f5imalused<\/a><\/noindex>, samuti <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">rakendamine ja seadistamine<\/a><\/noindex>. Praegu pakun v\u00e4lja j\u00e4tkata ja arutada, kuidas t\u00f6\u00f6tada alarmide ja turvaincidentide uurimisega, mida see lahendus genereerib. Toome esile 6 n\u00e4idet, mis, loodan, annavad hea \u00fclevaate toote kasulikkusest.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nEsiteks tuleb m\u00e4rkida, et StealthWatchis on olemas teatud jaotamine alarmide ja voogude vahel. Esimesed on eri liiki alarmid, millest aktiveerimisel saab avastada kahtlast tegevust v\u00f5rgus. Teised on turvaincidentide n\u00e4ited. Selles artiklis vaatleme 4 n\u00e4idet algoritmide alarmidest ja 2 n\u00e4idet voogudest.<\/p>\n<h2>1. V\u00f5rgusiseste suurima liikluse anal\u00fc\u00fcs<\/h2>\n<p>\nStealthWatchi seadistamise esialgne samm on hostide ja v\u00f5rkude m\u00e4\u00e4ramine gruppide kaupa. Veebiliidese vahekaart <i>Configure &gt; Host Group Management<\/i> v\u00f5imaldab jaotada v\u00f5rgud, hostid, serverid vastavatesse gruppidesse. Gruppide loomine on samuti v\u00f5imalik. Muide, hostidevahelise suhtluse anal\u00fc\u00fcs Cisco StealthWatchis on \u00fcsna mugav, kuna saab mitte ainult salvestada otsingufiltreid voogude j\u00e4rgi, vaid ka ise tulemusi.<\/p>\n<p>Alustamiseks peaksite veebiliideses minema vahekaardile <i>Analyze &gt; Flow Search<\/i>. Seej\u00e4rel tuleks m\u00e4\u00e4rata j\u00e4rgmised parameetrid:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (k\u00f5ige populaarsemad suhtlused)<\/li>\n<li>Time Range \u2014 24 hours (ajavahemik, v\u00f5ib kasutada ka muud)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (\u00fcksk\u00f5ik milline arusaadav nimi)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (allikas \u2014 sisehostide grupp)<\/li>\n<li>Connection (saate m\u00e4\u00e4rata sadamate, rakenduste)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (sihtkoht \u2014 sisehostide grupp)<\/li>\n<li>Advanced Options sektsioonis on lisaks v\u00f5imalik m\u00e4\u00e4rata koguja, millest andmeid vaadatakse, v\u00e4ljundi sorteerimine (baidid, vood jne). J\u00e4tan vaikeseaded.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast nupu vajutamist <i>Otsi <\/i>v\u00e4ljastatakse suhtlemiste loetelu, mis on juba sorteeritud edastatud andmete mahu j\u00e4rgi.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMinu n\u00e4ites on host <i>10.150.1.201<\/i> (server) \u00fche voolu raames edastanud<i> 1,5 GB<\/i> liiklust hostile <i>10.150.1.200<\/i> (klient) protokolli kaudu <i>mysql<\/i>. Nupp <i>Manage Columns<\/i> lubab lisada rohkem veerge v\u00e4ljundandmetesse.<\/p>\n<p>Edasi on administraatori valikul v\u00f5imalik luua kohandatud reegel, mis aktiveerub pidevalt selliste suhtlemiste korral ja teavitab SNMP, e-posti v\u00f5i Syslog kaudu. <\/p>\n<h2>2. Aeglasteimete klient-server suhtlemiste anal\u00fc\u00fcs v\u00f5rgu sees viivituste osas<\/h2>\n<p>\nM\u00e4rgid <b>SRT (Server Response Time)<\/b>, <b>RTT (Round Trip Time)<\/b> aitavad v\u00e4lja selgitada serverite viivitusi ja \u00fcldisi viivitusi v\u00f5rgus. See t\u00f6\u00f6riist on eriti mugav, kui tuleb kiiresti leida p\u00f5hjus kasutajate kaebustele aeglaselt toimiva rakenduse kohta.<\/p>\n<p><i>M\u00e4rkus<\/i>: praktiliselt k\u00f5ik Netflow eksportijad <b>ei oska<\/b> saada SRT, RTT m\u00e4rke, seega sageli, et n\u00e4ha selliseid andmeid FlowSensoris, tuleb seadistada v\u00f5rgu seadmetest edasisaadetava liikluse koopia saatmine. FlowSensor omakorda edastab laiendatud IPFIX FlowCollectorile.<\/p>\n<p>Sellist anal\u00fc\u00fcsi on mugavam teha java rakenduses StealthWatch, mis installitakse administraatori arvutisse.<\/p>\n<p>Paremkl\u00f5psake <i>Inside Hosts<\/i> ja liikuge vahelehele <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKl\u00f5psake <i>Filter <\/i>ja seadistage vajalikud parameetrid. N\u00e4itena:<\/p>\n<ul>\n<li>Kuup\u00e4ev\/Aeg \u2014 Viimase 3 p\u00e4eva jooksul<\/li>\n<li>J\u00f5udlus \u2014 Keskmine Round Trip Time &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAndmete v\u00e4ljastamise j\u00e4rel peaksite lisama meid huvitavad RTT, SRT v\u00e4ljad. Selleks tuleb kl\u00f5psata ekraanipildil veergu ja parema hiirekl\u00f5psuga valida <i>Manage Columns<\/i>. J\u00e4tkake RTT, SRT parameetrite kl\u00f5psamist.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast p\u00e4ringu t\u00f6\u00f6tlemist olen sorteerinud RTT keskmise j\u00e4rgi ja n\u00e4inud aeglasemaid suhtlemisi.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEt s\u00fcveneda detailidesse, tuleks parema hiirekl\u00f5psuga kl\u00f5psata voolule ja valida <i>Quick View for Flow<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSee teave n\u00e4itab, et host <i>10.201.3.59<\/i> grupist <i>Sales and Marketing<\/i> protokolli kaudu <i>NFS<\/i> kutsutakse <i>DNS serverile<\/i> \u00fche minuti ja 23 sekundi jooksul ja omab kohutavat viivitust. Vahekaart <i>Interfaces <\/i>n\u00e4itab, milliselt Netflow eksportijalt saadud teave on saadud. Vahekaardil <i>Table <\/i> on esitatud p\u00f5hjalikum teave suhtlemise kohta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEdasi tuleks v\u00e4lja selgitada, millised seadmed saadavad liiklust FlowSensorile ja probleem on t\u00f5en\u00e4oliselt seal.<\/p>\n<p>Lisaks on StealthWatch ainulaadne, sest see viib l\u00e4bi <b>deduplication<\/b> and (combines the same streams). Therefore, data can be collected from almost all Netflow devices without worrying about excessive duplicate data. On the contrary, in this scheme, it helps to understand where the largest delays occur on which hop.<\/p>\n<h2>3. Audit of HTTPS Cryptographic Protocols<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> \u2014 a technology developed by Cisco that allows the detection of malicious connections in encrypted traffic without decrypting it. Moreover, this technology makes it possible to 'disassemble' HTTPS into TLS versions and cryptographic protocols used during connections. This functionality is especially useful when trying to identify network nodes using weak cryptographic standards.<\/p>\n<p><i>M\u00e4rkus<\/i>: it is necessary to first install the network app on StealthWatch \u2014 <b>ETA Cryptographic Audit<\/b>.<\/p>\n<p>Liigume vahekaardile <i>Dashboards \u2192 ETA Cryptographic Audit<\/i> and select the host group intended for analysis. For a complete picture, let's choose <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIt can be observed that the TLS version and corresponding cryptographic standard are displayed. As per the usual scheme, in the column <i>Toimingud <\/i>we go to <i>View Flows<\/i> and the search starts in a new tab.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFrom the output, it is clear that the host <i>198.19.20.136<\/i> has used HTTPS with TLS 1.2 for <i>12 hours<\/i> , where the encryption algorithm <i>AES-256<\/i> and hash function <i>SHA-384<\/i>. Thus, ETA allows for the identification of weak algorithms in the network.<\/p>\n<h2>4. Network Anomaly Analysis<\/h2>\n<p>\nCisco StealthWatch can recognize traffic anomalies in the network using three tools: <b>Core Events<\/b> (security events), <b>Relationship Events<\/b> (events of interactions between segments, network nodes) and <b>behavioral analysis<\/b>.<\/p>\n<p>Behavioral analysis, in turn, allows the system to build a behavior model for a given host or group of hosts over time. The more traffic passes through StealthWatch, the more accurate the triggers will be thanks to this analysis. Initially, the system triggers many false positives, so the rules should be 'fine-tuned' manually. I recommend not paying attention to such events for the first few weeks, as the system will adjust itself, or add to exceptions.<\/p>\n<p>Below is an example of a preconfigured rule <i>Anomaly<\/i>, which states that the event will trigger without alarm if <i>a host in the Inside Hosts group interacts with the Inside Hosts group and the traffic exceeds 10 megabytes within 24 hours.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFor example, let's take the alarm <i>Data Hoarding<\/i>, mis t\u00e4hendab, et m\u00f5ni allika\/sihtkoha host on tahtmatult laadinud\/ennustanud anomaalselt suurt andmehulka gruppidelt v\u00f5i hostilt. Kl\u00f5psame s\u00fcndmusele ja s\u00fcveneme tabelisse, kus on loetletud k\u00e4ivitavad hostid. J\u00e4tkame valides meid huvitava hosti veerus <i>Data Hoarding<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuvatakse s\u00fcndmus, mis \u00fctleb, et avastatud on 162k \u201cpunkti\u201d, samas kui poliitika lubab 100k \u201cpunkti\u201d \u2014 need on StealthWatchi sisemised m\u00f5\u00f5dikud. Veerus <i>Toimingud <\/i>ja vajutame <i>View Flows<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSaame j\u00e4lgida, et <i>antud host<\/i> \u00f6\u00f6siti suhtles hostiga <i>10.201.3.47<\/i> osakonnast <i>M\u00fc\u00fcgi ja turundus<\/i> protokolli kaudu <i>HTTPS <\/i>ja laadis alla <i>1.4 Gt<\/i>. See n\u00e4ide v\u00f5ib olla mitte k\u00f5ige parem, kuid suhtluste avastamine isegi mitmesaja gigabaidi ulatuses toimub t\u00e4pselt sama meetodiga. Seega v\u00f5ib edasine anomaaliate uurimine viia huvitavate tulemusteni.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>M\u00e4rkus<\/i>: SMC veebiliideses andmed vahekaartides <i>Esitlused <\/i>kuvatakse ainult viimase n\u00e4dala andmed ja vahekaardil <i>Monitor<\/i> eelmisel 2 n\u00e4dalal. Vanemate s\u00fcndmuste anal\u00fc\u00fcsimiseks ja aruannete genereerimiseks tuleb t\u00f6\u00f6tada administraatori arvutil Java konsoolis.<\/p>\n<h2>5. Sisev\u00f5rgu skannimiste leidmine<\/h2>\n<p>\nN\u00fc\u00fcd vaatame m\u00f5ningaid n\u00e4iteid toidust \u2014 turvaintsidente. See funktsionaalsus on enamasti huvitav turvat\u00f6\u00f6tajatele.<\/p>\n<p>StealthWatchis on m\u00f5ned eelkonfigureeritud skannimise s\u00fcndmust\u00fc\u00fcbid:<\/p>\n<ul>\n<li>Port Scan \u2014 allikas skannib sihtkoha node paljusid porte.<\/li>\n<li>Addr tcp skannimine \u2014 allikas skannib kogu v\u00f5rku \u00fche ja sama TCP pordi kaudu, muutes samal ajal sihtkoha IP-aadressi. Samuti saab allikas TCP Reset pakette v\u00f5i ei saa vastuseid \u00fcldse.<\/li>\n<li>Addr udp skannimine \u2014 allikas skannib kogu v\u00f5rku \u00fche ja sama UDP pordi kaudu, muutes samal ajal sihtkoha IP-aadressi. Allikas saab ICMP Port Unreachable pakette v\u00f5i ei saa vastuseid \u00fcldse.<\/li>\n<li>Ping Scan \u2014 allikas saadab ICMP p\u00e4ringud kogu v\u00f5rku eesm\u00e4rgiga leida vastuseid.<\/li>\n<li>Stealth Scan tcp\/udp \u2014 allikas kasutas sama pordi, et \u00fchendada paljude portidega sihtkoha node\u2019il samal ajal.<\/li>\n<\/ul>\n<p>\nKohandatud siseskannerite mugavamaks leidmiseks on StealthWatchile olemas v\u00f5rgurakendus <i>StealthWatch \u2014 N\u00e4htavuse hindamine<\/i>. Kl\u00f5psates vahekaardil <i>Esitlused \u2192 N\u00e4htavuse hindamine \u2192 Sisev\u00f5rgu skannerid<\/i> n\u00e4ete viimase 2 n\u00e4dala jooksul nende skannimisega seotud turvaintsidente.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKl\u00f5psates nuppu <i>Detailid<\/i>, skaneerimise algust igas v\u00f5rgus, liiklusuundumust ja vastavaid h\u00e4ireid.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeej\u00e4rel saab minna 'hosti' eelmises ekraanipildis olevast vahekaardist ja n\u00e4ha turbe\u00fcritusi ning aktiivsust selle hosti jaoks viimase n\u00e4dala jooksul.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e4iteks anal\u00fc\u00fcsime \u00fchte s\u00fcndmust <i>Port Scan<\/i> hostilt <i>10.201.3.149<\/i> . Tundub, et <i>10.201.0.72<\/i>, kl\u00f5psake <i>Actions &gt; Associated Flows<\/i>. K\u00e4ivitatakse voogude otsing ja kuvatakse asjakohane teave.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNagu n\u00e4eme, skaneeris see host \u00fche oma sadama kaudu <i>51508\/TCP<\/i> 3 tundi tagasi sihthostit sadamates<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. M\u00f5ned v\u00e4ljad ei n\u00e4ita teavet, kuna k\u00f5ik Netflow v\u00e4ljad ei toeta Netflow eksportijat.<\/p>\n<h2>6. Laaditud pahavara anal\u00fc\u00fcs CTA abil<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> on Cisco pilveanal\u00fc\u00fcs, mis integreerub suurep\u00e4raselt Cisco StealthWatchiga ja v\u00f5imaldab t\u00e4iendada allkirjata anal\u00fc\u00fcsi allkirjastatud anal\u00fc\u00fcsiga. Seega on v\u00f5imalik avastada troojaneid, v\u00f5rguussid, nullp\u00e4eva pahavara ja muid pahavara ning nende levikut v\u00f5rgus. Samuti v\u00f5imaldab varem mainitud ETA tehnoloogia anal\u00fc\u00fcsida selliseid pahatahtlikke suhtlusi ka kr\u00fcpteeritud liikluses.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJuba esimeses vahekaardis veebiliideses on spetsiaalne vidin <i>Cognitive Threat Analytics<\/i>. L\u00fchikokkuv\u00f5te n\u00e4itab tuvastatud ohte kasutajate hostides: troojan, petturlik tarkvara, t\u00fc\u00fctuline reklaamvara. S\u00f5na \u201cEncrypted\u201d viitab just ETA t\u00f6\u00f6le. Kl\u00f5psates hostil, ilmub kogu teave, sealhulgas turbe\u00fcritused ja logid CTA kohta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIga CTA etapi kohal hoovatesse ilmub p\u00f5hjalik teave suhtlemise kohta. T\u00e4ielikuks anal\u00fc\u00fcsiks tasub vajutada <i>View Incident Details<\/i>, ja sisestate eraldi kontosse <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAknas paremas \u00fclanurgas on filter, mis v\u00f5imaldab kuvada s\u00fcndmusi t\u00f5siduse taseme j\u00e4rgi. Spetsiifilise anomaalia kohal hoovatesse ilmuvad ekraani alumises osas logid vastava ajaskaala paremas servas. Seega m\u00f5istab siseteabe osakonna spetsialist selgelt, milline nakatunud host hakkas p\u00e4rast milliseid toiminguid milliseid toiminguid tegemiseks.<\/p>\n<p>Allpool on veel \u00fcks n\u00e4ide - pangandustroojan, millega host nakatus <i>198.19.30.36<\/i>. T\u00f5endatud host hakkas suhtlema pahavara domeenidega ja logides on teave nende suhtluste voogude kohta. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fc\u00fcs ja intsidentide uurimine. Osa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4rgmine \u00fcks parimaid lahendusi, mis v\u00f5imalik, on hosti karantiini panemine t\u00e4nu natiivsele <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integreerimise <\/a><\/noindex>Cisco ISE edasi ravimiseks ja anal\u00fc\u00fcsimiseks. <\/p>\n<h2>Kokkuv\u00f5te<\/h2>\n<p>\nCisco StealthWatch on \u00fcks juhtivaid v\u00f5rguhalduse tooteid nii v\u00f5rgu anal\u00fc\u00fcsi kui ka teabe turvalisuse osas. Selle abil on v\u00f5imalik tuvastada ebaseaduslikke suhtlusi, rakenduste viivitusi, k\u00f5ige aktiivsemaid kasutajaid, anomaaliaid, pahavara ja APT-d. Veel enam, saab leida skaneeringuid, pentesterid, teostada HTTPS liikluse kr\u00fcptoaudite. Veelgi rohkem kasutusjuhte leiate <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">lingil<\/a><\/noindex>.<\/p>\n<p>Kui teil on soov kontrollida, kui sujuvalt ja t\u00f5husalt teie v\u00f5rgus k\u00f5ik t\u00f6\u00f6tab, saatke <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">taotluse<\/a><\/noindex>. <br \/>\nPeagi plaanime veel mitmeid tehnilisi publikatsioone erinevate k\u00fcberturbe toodete kohta. Kui see teema teid huvitab, j\u00e4lgige meie kanalite v\u00e4rskendusi (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: juhtumite anal\u00fc\u00fcs ja uurimine. Osa 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}