{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> je analiti\u010dko rje\u0161enje u podru\u010dju informacijske sigurnosti koje omogu\u0107uje sveobuhvatan nadzor prijetnji u distribuiranoj mre\u017ei. Temelji se na prikupljanju NetFlow i IPFIX s usmjeriva\u010da, mre\u017enih prekida\u010da i drugih mre\u017enih ure\u0111aja. Kao rezultat, mre\u017ea postaje osjetljivi senzor i omogu\u0107ava administratoru da zaviri tamo gdje tradicionalne metode za\u0161tite mre\u017ee, poput Next Generation Firewall-a, ne mogu.<\/p>\n<p>U pro\u0161lim \u010dlancima ve\u0107 sam pisao o StealthWatch-u: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prvo predstavljanje i mogu\u0107nosti<\/a><\/noindex>, kao i <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">implementacija i konfiguracija<\/a><\/noindex>. Sada predla\u017eem da idemo dalje i razgovaramo o tome kako trebamo raditi s alarmima i istra\u017eivati sigurnosne incidente koje generira ovo rje\u0161enje. Bit \u0107e prikazano 6 primjera koji, nadam se, pru\u017eaju dobar uvid u korisnost proizvoda.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPrvo treba re\u0107i da StealthWatch ima odre\u0111enu distribuciju aktivacija izme\u0111u algoritama i feedova. Prvi su razli\u010dite vrste alarma (obavijesti), \u010dijom aktivacijom se mogu otkriti sumnjive stvari u mre\u017ei. Drugi su sigurnosni incidenti. U ovom \u010dlanku bit \u0107e prikazana 4 primjera aktivacija algoritama i 2 primjera feedova.<\/p>\n<h2>1. Analiza najve\u0107ih interakcija unutar mre\u017ee<\/h2>\n<p>\nPrvi korak u konfiguraciji StealthWatch-a je definiranje hostova i mre\u017ea po grupama. U web su\u010delju kartica <i>Configure &gt; Host Group Management<\/i> treba razvrstati mre\u017ee, hostove, servere u odgovaraju\u0107e grupe. Grupe se mogu i kreirati. Ina\u010de, analiza interakcija izme\u0111u hostova u Cisco StealthWatch-u je prili\u010dno zgodna, jer mo\u017eete ne samo spremiti filtre pretra\u017eivanja po tokovima, ve\u0107 i same rezultate.<\/p>\n<p>Za po\u010detak, u web su\u010delju potrebno je oti\u0107i na karticu <i>Analyze &gt; Flow Search<\/i>. Zatim je potrebno postaviti sljede\u0107e parametre:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (najpopularnije interakcije)<\/li>\n<li>Time Range \u2014 24 hours (vrijeme trajanja, mo\u017eete koristiti i drugo)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (bilo koje razumljivo ime)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (izvor \u2014 skupina unutarnjih \u010dvorova)<\/li>\n<li>Connection (mo\u017eete odrediti portove, aplikacije)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (odredi\u0161te \u2014 skupina unutarnjih \u010dvorova)<\/li>\n<li>U Advanced Options dodatno mo\u017eete odrediti kolektor s kojeg se pregledavaju podaci, sortiranje izlaza (po bajtovima, tokovima i dr.). Ostavit \u0107u prema zadanim postavkama.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNakon \u0161to pritisnemo gumb <i>Pretra\u017ei <\/i>izdan je popis interakcija koje su ve\u0107 sortirane prema koli\u010dini prenesenih podataka.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nU mom primjeru, host <i>10.150.1.201<\/i> (server) u okviru samo jednog toka prenio je<i> 1.5 GB<\/i> prometa na host <i>10.150.1.200<\/i> (klijent) putem protokola <i>mysql<\/i>. Gumb <i>Upravljanje stupcima<\/i> omogu\u0107uje dodavanje vi\u0161e stupaca u prikazane podatke.<\/p>\n<p>Nakon toga, proizvoljno se mo\u017ee stvoriti prilago\u0111eno pravilo koje \u0107e se stalno aktivirati za takve vrste interakcija i obavje\u0161tavati putem SNMP-a, e-po\u0161te ili Sysloga. <\/p>\n<h2>2. Analiza najsporijih klijent-server interakcija unutar mre\u017ee u smislu ka\u0161njenja<\/h2>\n<p>\nOznake <b>SRT (Vrijeme odgovora servera)<\/b>, <b>RTT (Vrijeme povratka)<\/b> omogu\u0107uju otkrivanje ka\u0161njenja servera i ukupnih ka\u0161njenja u mre\u017ei. Ovaj alat je posebno koristan kada treba brzo prona\u0107i uzrok pritu\u017ebi korisnika na sporo radno aplikacije.<\/p>\n<p><i>Napomena<\/i>: gotovo svi Netflow izvo\u0111a\u010di <b>ne mogu<\/b> slati oznake SRT, RTT, stoga se \u010desto, kako bi se vidjeli ti podaci na FlowSensoru, mora postaviti slanje kopije prometa s mre\u017enih ure\u0111aja. FlowSensor zauzvrat daje pro\u0161ireni IPFIX na FlowCollector.<\/p>\n<p>Ovu analitiku je prikladnije provoditi u java aplikaciji StealthWatch, koja se instalira na ra\u010dunalom administratora.<\/p>\n<p>Desnim klikom na <i>Unutarnji hostovi<\/i> i prelazimo na karticu <i>Flow tabela<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKliknite na <i>Filtriraj <\/i>i postavite potrebne parametre. Kao primjer:<\/p>\n<ul>\n<li>Datum\/Vrijeme \u2014 Za posljednja 3 dana<\/li>\n<li>Performanse \u2014 Prosje\u010dno vrijeme povratka &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNakon prikaza podataka, treba dodati zanimljive nam RTT, SRT polja. Da biste to u\u010dinili, treba pritisnuti na stupac na snimci i desnim klikom odabrati <i>Upravljanje stupcima<\/i>. Nakon toga se treba proklizati kroz RTT, SRT parametre.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNakon obrade upita, sortirano sam po prosje\u010dnom RTT i vidio najsporije interakcije.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDa biste dobili detaljne informacije, treba desnim klikom na tok i odabrati <i>Brzi pregled toka<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOve informacije upu\u0107uju na to da host <i>10.201.3.59<\/i> iz grupe <i>Prodaja i marketing<\/i> putem protokola <i>NFS<\/i> obra\u0111uje se prema <i>DNS serveru<\/i> tijekom jedne minute i 23 sekunde te ima izuzetno lo\u0161e ka\u0161njenje. Na kartici <i>Interfejsi <\/i>mo\u017ee se saznati iz kojeg Netflow izvo\u0111a\u010da su podaci prikupljeni. Na kartici <i>Tabela <\/i> prikazana je detaljnija informacija o interakciji.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNakon toga treba saznati koji ure\u0111aji \u0161alju promet na FlowSensor i problem se vjerojatno nalazi tamo.<\/p>\n<p>Osim toga, StealthWatch je jedinstven po tome \u0161to provodi <b>dedupliciranje<\/b> podataka (spaja iste tokove). Stoga, mogu\u0107e je prikupljati podatke sa gotovo svih ure\u0111aja Netflow bez straha od ponavljanja informacija. U stvari, u ovoj shemi to \u0107e pomo\u0107i da se razjasni na kojem se hopu javljaju najve\u0107e latencije.<\/p>\n<h2>3. Revizija kriptografskih protokola HTTPS<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> \u2014 tehnologija koju je razvila Cisco, koja omogu\u0107ava otkrivanje zlonamjernih povezivanja u \u0161ifriranom prometu bez njegovo de\u0161ifriranja. Osim toga, ova tehnologija omogu\u0107ava \"razlikovanje\" HTTPS na verzije TLS i kriptografske protokole koji se koriste prilikom povezivanja. Ova funkcionalnost je posebno korisna kada je potrebno otkriti mre\u017ene \u010dvorove koji koriste slabe kripto standarde.<\/p>\n<p><i>Napomena<\/i>: unaprijed treba instalirati mre\u017enu aplikaciju na StealthWatch \u2014 <b>ETA Kriptografska Revizija<\/b>.<\/p>\n<p>Pristupamo kartici <i>Kontrolne plo\u010de \u2192 ETA Kriptografska Revizija<\/i> i odabiremo grupu hostova koju planiramo analizirati. Za sveobuhvatan pregled izabrat \u0107emo <i>Unutarnji hostovi<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMo\u017eemo uo\u010diti da se prikazuju verzija TLS i odgovaraju\u0107i kripto standard. Prema o\u010dekivanoj shemi u koloni <i>Radnje <\/i>pristupamo <i>Prikaz Tokova<\/i> i zapo\u010dinje pretraga u novoj kartici.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIz izlaza se vidi da je host <i>198.19.20.136<\/i> tokom <i>12 sati<\/i> koristio HTTPS s TLS 1.2, gdje je algoritam \u0161ifriranja <i>AES-256<\/i> i hash funkcija <i>SHA-384<\/i>. Tako, ETA omogu\u0107ava pronala\u017eenje slabih algoritama u mre\u017ei.<\/p>\n<h2>4. Analiza anomalija u mre\u017ei<\/h2>\n<p>\nCisco StealthWatch mo\u017ee prepoznati anomalije prometa u mre\u017ei, koriste\u0107i tri alata: <b>Osnovni doga\u0111aji<\/b> (doga\u0111aji sigurnosti), <b>Doga\u0111aji odnosa<\/b> (doga\u0111aji interakcije izme\u0111u segmenata, \u010dvorova mre\u017ee) i <b>analiza pona\u0161anja<\/b>.<\/p>\n<p>Analiza pona\u0161anja, s druge strane, omogu\u0107ava tokom vremena izgradnju modela pona\u0161anja za odre\u0111eni host ili grupu hostova. \u0160to vi\u0161e prometa prolazi kroz StealthWatch, to \u0107e biti preciznije aktivacije zahvaljuju\u0107i ovoj analizi. Na po\u010detku sustav \u010desto pogre\u0161no aktivira, pa pravila treba \"prilago\u0111avati\" ru\u010dno. Preporu\u010dujem da u prva nekoliko tjedana ne obra\u0107ate pa\u017enju na takve doga\u0111aje, jer \u0107e se sustav sam podesiti, ili dodavati u iznimke.<\/p>\n<p>Ispod je primjer unaprijed postavljenog pravila <i>Anomalija<\/i>, u kojem se navodi da \u0107e doga\u0111aj reagirati bez alarma ako <i>host u grupi Inside Hosts komunicira s grupom Inside Hosts i u 24 sata promet prema\u0161i 10 megabajta.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUze\u0107emo alarm kao primer <i>Hoarding podataka<\/i>, \u0161to zna\u010di da je neki izvorni\/odredi\u0161ni host u\u010ditao\/preuzeo neprirodno veliku koli\u010dinu podataka iz grupe hostova ili sa hosta. Kliknite na doga\u0111aj i pre\u0111ite na tabelu koja prikazuje hostove koji su izazvali alarm. Zatim odaberite interesantni host u koloni <i>Hoarding podataka<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrikazan je doga\u0111aj koji govori da je otkriveno 162k \"poena\", dok je po politici dozvoljeno 100k \"poena\" \u2014 to su unutra\u0161nje metrike StealthWatch. U koloni <i>Radnje <\/i>kliknite <i>Prikaz Tokova<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMo\u017eemo primetiti da <i>ovaj host<\/i> no\u0107u je komunicirao sa hostom <i>10.201.3.47<\/i> iz odeljenja <i>Prodaja i marketing<\/i> putem protokola <i>HTTPS <\/i>i preuzeo <i>1.4 GB<\/i>. Mo\u017eda ovaj primer nije ba\u0161 najbolji, ali detekcija interakcija sa vi\u0161e stotina gigabajta vr\u0161i se na isti na\u010din. Stoga, dalja istraga anomalija mo\u017ee dovesti do zanimljivih rezultata.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Napomena<\/i>: u web-interfejsu SMC podaci se prikazuju u karticama <i>Kontrolne table <\/i>prikazuju se samo za poslednju nedelju, dok se u kartici <i>Monitor<\/i> prikazuju podaci za poslednje 2 nedelje. Da bi se analizirali doga\u0111aji starijeg datuma i generisali izve\u0161taji, potrebno je raditi sa java konzolom na ra\u010dunarima administratora.<\/p>\n<h2>5. Pronalazak unutra\u0161njih skeniranja mre\u017ee<\/h2>\n<p>\nSada razmotrimo nekoliko primera uvida \u2014 incidenta informacione bezbednosti. Ova funkcionalnost je vi\u0161e zanimljiva bezbednjacima.<\/p>\n<p>Postoji nekoliko unapred definisanih tipova doga\u0111aja skeniranja u StealthWatch:<\/p>\n<ul>\n<li>Skeniranje portova \u2014 izvor skenira vi\u0161e portova odredi\u0161nog \u010dvora.<\/li>\n<li>Addr tcp skeniranje \u2014 izvor skenira celu mre\u017eu na istom TCP portu, menjaju\u0107i IP adresu odredi\u0161ta. Pri tome izvor prima TCP Reset pakete ili uop\u0161te ne dobija odgovore.<\/li>\n<li>Addr udp skeniranje \u2014 izvor skenira celu mre\u017eu na istom UDP portu, menjaju\u0107i IP adresu odredi\u0161ta. Pri tome izvor prima ICMP Port Unreachable pakete ili uop\u0161te ne dobija odgovore.<\/li>\n<li>Ping skeniranje \u2014 izvor \u0161alje ICMP zahteve na celu mre\u017eu u potrazi za odgovorima.<\/li>\n<li>Stealth skeniranje tcp\/udp \u2014 izvor je koristio isti port za povezivanje na vi\u0161e portova odredi\u0161nog \u010dvora u isto vreme.<\/li>\n<\/ul>\n<p>\nZa lak\u0161e pronala\u017eenje svih unutra\u0161njih skeneri postoji aplikacija za mre\u017eu za <i>StealthWatch \u2014 Procena vidljivosti<\/i>. Kada pre\u0111ete na karticu <i>Kontrolne table \u2192 Procena vidljivosti \u2192 Unutra\u0161nji mre\u017eni skeneri<\/i> vide\u0107ete incidente bezbednosti vezane za skeniranja u poslednje 2 nedelje.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlikom na dugme <i>Detalji<\/i>, bit \u0107e vidljive po\u010detke skeniranja svake mre\u017ee, trendovi prometa i odgovaraju\u0107i alarmi.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZatim se mo\u017eete \"uroniti\" u host iz kartice na prethodnoj slici i vidjeti sigurnosne doga\u0111aje, kao i aktivnost proteklih tjedan dana za taj host.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKao primjer, analizirat \u0107emo doga\u0111aj <i>Skeniranje portova<\/i> s hosta <i>10.201.3.149<\/i> na <i>10.201.0.72<\/i>, kliknuv\u0161i na <i>Radnje &gt; Povezani tokovi<\/i>. Pokre\u0107e se pretra\u017eivanje tokova i prikazuje relevantne informacije.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKao \u0161to vidimo, ovaj host s jednog svog porta <i>51508\/TCP<\/i> skanio je prije 3 sata odredi\u0161ni host preko portova<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. Neka polja ne prikazuju informacije, ili zato \u0161to nisu sva polja Netflow podr\u017eana na Netflow eksterneru.<\/p>\n<h2>6. Analiza preuzetih zlo\u0107udnih programa pomo\u0107u CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 obla\u010dna analiza Ciscoa, koja se odli\u010dno integrira s Cisco StealthWatch i omogu\u0107ava dopunu bezpravi\u010dne analize potpisima. Tim se omogu\u0107ava otkrivanje trojanaca, mre\u017enih crva, zlo\u0107udnog softvera nultog dana i drugih zlo\u0107udnih programa i njihovo \u0161irenje unutar mre\u017ee. Tako\u0111er, ranije spomenuta tehnologija ETA omogu\u0107ava analizu takvih zlo\u0107udnih komunikacija i u \u0161ifriranom prometu.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDoslovno na prvoj kartici u web su\u010delju postoji poseban widget <i>Cognitive Threat Analytics<\/i>. Kratki pregled govori o otkrivenim prijetnjama na korisni\u010dkim hostovima: trojanac, zlo\u0107udni softver, napadni softver. Rije\u010d \u201cEncrypted\u201d upravo ukazuje na rad ETA. Klikom na host, ispu\u0161ta se sve informacije, uklju\u010duju\u0107i sigurnosne doga\u0111aje i dnevnike o CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrelaze\u0107i preko svakog koraka CTA, doga\u0111aji prikazuju detaljne informacije o interakciji. Za potpuni uvid, trebate kliknuti <i>Pogledajte detalje incidenta<\/i>, i dobit \u0107ete posebnu konzolu. <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nU gornjem desnom kutu filtriranje omogu\u0107ava prikazivanje doga\u0111aja prema razini kriti\u010dnosti. Prelaze\u0107i preko konkretne anomalije, na dnu ekrana pojavljuju se dnevnici s odgovaraju\u0107im vremenskim okvirom s desne strane. Tako stru\u010dnjak odjela IB jasno razumije koji zara\u017eeni host je nakon kojih radnji po\u010deo izvoditi koje radnje.<\/p>\n<p>Ispod je jo\u0161 jedan primjer \u2014 bankovni trojanac, kojim je zara\u017een host <i>198.19.30.36<\/i>. Ovaj host je po\u010deo komunicirati sa zlo\u0107udnim domenama, a u dnevnicima je prikazana informacija o tokovima tih interakcija. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJedno od najboljih rje\u0161enja mo\u017ee biti stavljanje hosta u karantenu zahvaljuju\u0107i nativnoj <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integraciji <\/a><\/noindex>s Cisco ISE za daljnje lije\u010denje i analizu. <\/p>\n<h2>Zaklju\u010dak<\/h2>\n<p>\nCisco StealthWatch rje\u0161enje je jedno od vode\u0107ih proizvoda za monitoring mre\u017ee, kako iz perspektive analize mre\u017ee, tako i informacijske sigurnosti. Uz njegovo kori\u0161tenje mogu\u0107e je otkrivati nelegitimne interakcije unutar mre\u017ee, ka\u0161njenja aplikacija, najaktivnije korisnike, anomalije, zlonamjerne softvere i APT. \u0160tovi\u0161e, mogu\u0107e je detektirati skeniranja, pentestere i provoditi kriptoaudit HTTPS prometa. Jo\u0161 vi\u0161e scenarija upotrebe mo\u017eete prona\u0107i na <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">vezi<\/a><\/noindex>.<\/p>\n<p>Ako imate \u017eelju provjeriti kako va\u0161a mre\u017ea glatko i efikasno radi, po\u0161aljite <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">zahtjev<\/a><\/noindex>. <br \/>\nU bliskoj budu\u0107nosti planiramo jo\u0161 nekoliko tehni\u010dkih publikacija o razli\u010ditim proizvodima informacijske sigurnosti. Ako vas ova tematika zanima, pratite na\u0161e kanale za a\u017euriranja (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: analiza i istra\u017eivanje incidenata. Dio 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}