{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> este o solu\u021bie analitic\u0103 \u00een domeniul securit\u0103\u021bii informa\u021biei, care ofer\u0103 monitorizare complet\u0103 a amenin\u021b\u0103rilor \u00eentr-o re\u021bea distribuit\u0103. La baza func\u021bion\u0103rii StealthWatch st\u0103 colectarea NetFlow \u0219i IPFIX de la routere, switch-uri \u0219i alte dispozitive de re\u021bea. Ca rezultat, re\u021beaua devine un senzor sensibil \u0219i \u00eei permite administratorului s\u0103 p\u0103trund\u0103 \u00een zone inaccesibile metodelor tradi\u021bionale de protec\u021bie a re\u021belei, cum ar fi firewall-ul de nou\u0103 genera\u021bie.<\/p>\n<p>\u00cen articolele anterioare am scris deja despre StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prezentare ini\u021bial\u0103 \u0219i capabilit\u0103\u021bi<\/a><\/noindex>, dar \u0219i pentru <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">implementare \u0219i configurare<\/a><\/noindex>. Acum propun s\u0103 mergem mai departe \u0219i s\u0103 discut\u0103m despre cum s\u0103 gestion\u0103m alertele \u0219i s\u0103 investig\u0103m incidentele de securitate generate de solu\u021bie. Vor fi prezentate 6 exemple care, sper, vor oferi o bun\u0103 imagine despre utilitatea produsului.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u00cen primul r\u00e2nd, trebuie spus c\u0103 \u00een StealthWatch exist\u0103 o anumit\u0103 distribu\u021bie a activ\u0103rilor pe algoritmi \u0219i feed-uri. Primele sunt diverse tipuri de alerte (notific\u0103ri), care, la activare, pot detecta lucruri suspecte \u00een re\u021bea. Cele din urm\u0103 sunt incidente de securitate. \u00cen acest articol vor fi analizate 4 exemple de activ\u0103ri ale algoritmilor \u0219i 2 exemple de feed-uri.<\/p>\n<h2>1. Analiza celor mai voluminoase interac\u021biuni din re\u021bea<\/h2>\n<p>\nPrimul pas \u00een configurarea StealthWatch este definirea gazdelor \u0219i re\u021belelor pe grupuri. \u00cen interfa\u021ba web, tab-ul <i>Configure &gt; Host Group Management<\/i> ar trebui s\u0103 distribuie re\u021belele, gazdele \u0219i serverele \u00een grupurile corespunz\u0103toare. Grupurile pot fi create \u0219i personalizate. Apropo, analiza interac\u021biunilor dintre gazde \u00een Cisco StealthWatch este destul de convenabil\u0103, deoarece nu doar c\u0103 po\u021bi salva filtrele de c\u0103utare pe fluxuri, dar \u0219i rezultatele \u00een sine.<\/p>\n<p>Pentru \u00eenceput, \u00een interfa\u021ba web, ar trebui s\u0103 accesezi tab-ul <i>Analyze &gt; Flow Search<\/i>. Apoi, trebuie s\u0103 stabile\u0219ti urm\u0103toarele parametrii:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (cele mai populare interac\u021biuni)<\/li>\n<li>Time Range \u2014 24 hours (interval de timp, se poate folosi un altul)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (orice nume specific)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (sursa \u2014 grupul de noduri interne)<\/li>\n<li>Connection (po\u021bi specifica porturi, aplica\u021bii)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (destina\u021bia \u2014 grupul de noduri interne)<\/li>\n<li>\u00cen Advanced Options, po\u021bi specifica suplimentar colectorul de unde se vizualizeaz\u0103 datele, sortarea ie\u0219irii (dup\u0103 bytes, fluxuri etc.). Voi l\u0103sa implicit.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 ap\u0103sarea butonului <i>Cautare <\/i>se emite o list\u0103 de interac\u021biuni, care au fost deja sortate dup\u0103 volumul de date transferate.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen exemplul meu, gazda <i>10.150.1.201<\/i> (serverul) a transmis<i> 1.5 GB<\/i> trafic c\u0103tre gazd\u0103 <i>10.150.1.200<\/i> (client) prin protocolul <i>mysql<\/i>. Butonul <i>Manage Columns<\/i> permite ad\u0103ugarea mai multor coloane \u00een datele afi\u0219ate.<\/p>\n<p>Apoi, la discre\u021bia administratorului, se poate crea o regul\u0103 personalizat\u0103 care va ac\u021biona constant asupra acestui tip de interac\u021biuni \u0219i va notifica prin SNMP, email sau Syslog. <\/p>\n<h2>2. Analiza celor mai lente interac\u021biuni client-server din re\u021bea pentru \u00eent\u00e2rzieri<\/h2>\n<p>\nEtichete <b>SRT (Server Response Time)<\/b>, <b>RTT (Round Trip Time)<\/b> permit determinarea \u00eent\u00e2rzierilor serverelor \u0219i \u00eent\u00e2rzierilor generale \u00een re\u021bea. Acest instrument este deosebit de util atunci c\u00e2nd trebuie s\u0103 g\u0103se\u0219ti rapid cauza pl\u00e2ngerilor utilizatorilor despre aplica\u021bii care func\u021bioneaz\u0103 lent.<\/p>\n<p><i>Not\u0103<\/i>: practic toate exportatoarele Netflow <b>nu \u0219tiu<\/b> s\u0103 trimit\u0103 etichete SRT, RTT, prin urmare, de multe ori, pentru a vedea astfel de date pe FlowSensor, trebuie s\u0103 configurezi trimiterea unei copii a traficului de pe dispozitivele de re\u021bea. FlowSensor, la r\u00e2ndul s\u0103u, ofer\u0103 IPFIX extins pe FlowCollector.<\/p>\n<p>Aceast\u0103 analiz\u0103 este mai u\u0219or de realizat \u00een aplica\u021bia java StealthWatch, care se instaleaz\u0103 pe computerul administratorului.<\/p>\n<p>Click dreapta pe <i>Inside Hosts<\/i> \u0219i trecem la tab-ul <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFacem clic pe <i>Filter <\/i>\u0219i stabilim parametrii necesari. Ca exemplu:<\/p>\n<ul>\n<li>Date\/Time \u2014 Pentru ultimele 3 zile<\/li>\n<li>Performance \u2014 Timpul mediu de parcurs &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 ce datele sunt afi\u0219ate, trebuie s\u0103 ad\u0103ug\u0103m c\u00e2mpurile RTT, SRT de interes. Pentru aceasta, trebuie s\u0103 facem clic pe coloan\u0103 \u00een captura de ecran \u0219i s\u0103 alegem cu click dreapta <i>Manage Columns<\/i>. Apoi, select\u0103m parametrii RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 procesarea solicit\u0103rii, am sortat dup\u0103 RTT mediu \u0219i am v\u0103zut cele mai lente interac\u021biuni.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru a accesa informa\u021biile detaliate, trebuie s\u0103 facem clic dreapta pe flux \u0219i s\u0103 select\u0103m <i>Quick View for Flow<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAceast\u0103 informa\u021bie indic\u0103 faptul c\u0103 gazda <i>10.201.3.59<\/i> din grupul <i>Sales and Marketing<\/i> prin protocolul <i>NFS<\/i> se adreseaz\u0103 <i>serverului DNS<\/i> timp de un minut \u0219i 23 de secunde \u0219i are o \u00eent\u00e2rziere foarte mare. \u00cen tab-ul <i>Interfe\u021be <\/i>po\u021bi afla din ce exportator Netflow au fost ob\u021binate informa\u021biile. \u00cen tab-ul <i>Table <\/i> se prezint\u0103 informa\u021bii mai detaliate despre interac\u021biune.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApoi, trebuie s\u0103 afl\u0103m ce dispozitive trimit trafic c\u0103tre FlowSensor \u0219i problema se afl\u0103 probabil acolo.<\/p>\n<p>Mai mult, StealthWatch este unic prin faptul c\u0103 efectueaz\u0103 <b>deduplicare<\/b> informa\u021bii (consolid\u00e2nd fluxuri identice). Prin urmare, este posibil s\u0103 colectezi practic de pe toate dispozitivele Netflow f\u0103r\u0103 a-\u021bi face griji c\u0103 vor exista multe date redundante. Din contr\u0103, aceast\u0103 schem\u0103 va ajuta s\u0103 \u00een\u021belegem exact pe care hop are cele mai mari \u00eent\u00e2rzieri.<\/p>\n<h2>3. Auditul protocolului criptografic HTTPS<\/h2>\n<p>\n<b>ETA (Analiza Traficului Criptat)<\/b> \u2014 tehnologia dezvoltat\u0103 de Cisco care permite detectarea conexiunilor mali\u021bioase \u00een traficul criptat f\u0103r\u0103 a-l decripta. Mai mult, aceast\u0103 tehnologie permite \u201edescompunerea\u201d HTTPS \u00een versiunile TLS \u0219i protocoalele criptografice utilizate \u00een conexiuni. Aceast\u0103 func\u021bionalitate este deosebit de util\u0103 atunci c\u00e2nd trebuie s\u0103 identific\u0103m noduri de re\u021bea care utilizeaz\u0103 standarde criptografice slabe.<\/p>\n<p><i>Not\u0103<\/i>: \u00eenainte, trebuie s\u0103 instal\u0103m aplica\u021bia de re\u021bea pe StealthWatch \u2014 <b>Auditul Criptografic ETA<\/b>.<\/p>\n<p>Trecem la fila <i>Dashboard-uri \u2192 Audit Criptografic ETA<\/i> \u0219i alegem grupul de gazde pe care dorim s\u0103-l analiz\u0103m. Pentru a ob\u021bine o imagine de ansamblu, vom alege <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSe poate observa c\u0103 sunt afi\u0219ate versiunea TLS \u0219i standardul criptografic corespunz\u0103tor. Conform schemei obi\u0219nuite, \u00een coloan\u0103 <i>Ac\u021biuni <\/i>trecem la <i>Vizualizare Fluxuri<\/i> \u0219i c\u0103utarea se deschide \u00eentr-o nou\u0103 tab.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDin ie\u0219ire se poate observa c\u0103 gazda <i>198.19.20.136<\/i> pe parcursul <i>12 ore<\/i> a utilizat HTTPS cu TLS 1.2, unde algoritmul de criptare <i>AES-256<\/i> \u0219i func\u021bia de hash <i>SHA-384<\/i>. Astfel, ETA permite identificarea algoritmilor slabi din re\u021bea.<\/p>\n<h2>4. Analiza anomaliilor \u00een re\u021bea<\/h2>\n<p>\nCisco StealthWatch poate recunoa\u0219te anomalii \u00een trafic \u00een re\u021bea, folosind trei instrumente: <b>Evenimente de baz\u0103<\/b> (evenimente de securitate), <b>Evenimente de Rela\u021bie<\/b> (evenimente de interac\u021biune \u00eentre segmente, noduri de re\u021bea) \u0219i <b>analiz\u0103 comportamental\u0103<\/b>.<\/p>\n<p>Analiza comportamental\u0103, la r\u00e2ndul ei, permite construirea \u00een timp a unui model de comportament pentru o gazd\u0103 sau un grup de gazde. Cu c\u00e2t mai mult trafic trece prin StealthWatch, cu at\u00e2t mai precise vor fi declan\u0219\u0103rile datorit\u0103 acestei analize. La \u00eenceput, sistemul va declan\u0219a multe alerte eronate, a\u0219a c\u0103 regulile trebuie \u201eajustate\u201d manual. Recomand s\u0103 nu acorzi aten\u021bie acestor evenimente \u00een primele c\u00e2teva s\u0103pt\u0103m\u00e2ni, deoarece sistemul se va adapta singur, sau s\u0103 le adaugi \u00een excep\u021bii.<\/p>\n<p>Mai jos este un exemplu de regul\u0103 predefinit\u0103 <i>Anomalie<\/i>, care stipuleaz\u0103 c\u0103 evenimentul va fi declan\u0219at f\u0103r\u0103 alarm\u0103, dac\u0103 <i>gazda din grupul Gazdelor Interne interac\u021bioneaz\u0103 cu grupul Gazdelor Interne \u0219i \u00een 24 de ore traficul dep\u0103\u0219e\u0219te 10 megabai\u021bi.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCa exemplu, s\u0103 lu\u0103m alarma <i>Aprovizionarea cu date<\/i>, ceea ce \u00eenseamn\u0103 c\u0103 o anumit\u0103 gazd\u0103 surs\u0103\/destina\u021bie a \u00eenc\u0103rcat\/descarcat o cantitate anormal de mare de date de la un grup de gazde sau de la gazda respectiv\u0103. Facem clic pe eveniment \u0219i intr\u0103m \u00een tabelul unde sunt specificate gazdele factori declan\u0219atori. Apoi select\u0103m gazda de interes din coloan\u0103 <i>Aprovizionarea cu date<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSe afi\u0219eaz\u0103 un eveniment care indic\u0103 faptul c\u0103 au fost detectate 162k \"puncte\", iar politica permite 100k \"puncte\" \u2014 acestea sunt metricile interne StealthWatch. \u00cen coloan\u0103 <i>Ac\u021biuni <\/i>ap\u0103s\u0103m <i>Vizualizare Fluxuri<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPutem observa c\u0103 <i>aceast\u0103 gazd\u0103<\/i> a interac\u021bionat noaptea cu gazda <i>10.201.3.47<\/i> din departamentul <i>Sales &amp; Marketing<\/i> prin protocolul <i>HTTPS <\/i>\u0219i a desc\u0103rcat <i>1.4 GB<\/i>. Este posibil ca acest exemplu s\u0103 nu fie foarte reu\u0219it, dar detectarea interac\u021biunilor \u0219i a unor volume de sute de gigabytes se realizeaz\u0103 exact \u00een acela\u0219i mod. Prin urmare, o anchet\u0103 ulterioar\u0103 a anomaliilor ar putea conduce la rezultate interesante.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Not\u0103<\/i>: \u00een interfa\u021ba web SMC, datele din tab-uri <i>Dashboards <\/i>sunt afi\u0219ate doar pentru ultima s\u0103pt\u0103m\u00e2n\u0103 \u0219i \u00een tab-ul <i>Monitor<\/i> pentru ultimele 2 s\u0103pt\u0103m\u00e2ni. Pentru a analiza evenimente mai vechi \u0219i pentru generarea de rapoarte, este necesar s\u0103 se lucreze cu consola Java de pe computerul administratorului.<\/p>\n<h2>5. G\u0103sirea scan\u0103rilor interne ale re\u021belei<\/h2>\n<p>\nAcum s\u0103 lu\u0103m \u00een considerare c\u00e2teva exemple de feeduri \u2014 incidente de securitate. Aceast\u0103 func\u021bionalitate este mai interesant\u0103 pentru speciali\u0219tii \u00een securitate.<\/p>\n<p>Exist\u0103 mai multe tipuri prestabilite de evenimente de scanare \u00een StealthWatch:<\/p>\n<ul>\n<li>Scanare Port \u2014 sursa scaneaz\u0103 multe porturi ale nodului destina\u021bie.<\/li>\n<li>Scanare Addr tcp \u2014 sursa scaneaz\u0103 \u00eentreaga re\u021bea pe un singur port TCP, schimb\u00e2nd \u00een acela\u0219i timp adresa IP de destina\u021bie. \u00cen acest proces, sursa prime\u0219te pachete TCP Reset sau nu prime\u0219te r\u0103spunsuri deloc.<\/li>\n<li>Scanare Addr udp \u2014 sursa scaneaz\u0103 \u00eentreaga re\u021bea pe un singur port UDP, schimb\u00e2nd \u00een acela\u0219i timp adresa IP de destina\u021bie. \u00cen acest proces, sursa prime\u0219te pachete ICMP Port Unreachable sau nu prime\u0219te r\u0103spunsuri deloc.<\/li>\n<li>Ping Scan \u2014 sursa trimite solicit\u0103ri ICMP asupra \u00eentregii re\u021bele cu scopul de a c\u0103uta r\u0103spunsuri.<\/li>\n<li>Scanare Stealth tcp\/udp \u2014 sursa a folosit acela\u0219i port pentru a se conecta la multe porturi ale nodului destina\u021bie \u00een aceea\u0219i vreme.<\/li>\n<\/ul>\n<p>\nPentru o identificare mai convenabil\u0103 a tuturor scanerelor interne, exist\u0103 aplica\u021bia de re\u021bea pentru <i>StealthWatch \u2014 Evaluarea Vizibilit\u0103\u021bii<\/i>. Acces\u00e2nd tab-ul <i>Dashboards \u2192 Evaluarea Vizibilit\u0103\u021bii \u2192 Scanere Interne ale Re\u021belei<\/i> ve\u021bi vedea incidentele de securitate legate de scanare, pentru ultimele 2 s\u0103pt\u0103m\u00e2ni.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nF\u0103c\u00e2nd clic pe butonul <i>Detalii<\/i>, se va vedea \u00eenceputul scan\u0103rii fiec\u0103rei re\u021bele, trendul de trafic \u0219i alarmele corespunz\u0103toare.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApoi, pute\u021bi \u201eaprofundat\u201d pe gazd\u0103 din fila din captura de ecran anterioar\u0103 \u0219i vede\u021bi evenimentele de securitate, precum \u0219i activitatea din ultima s\u0103pt\u0103m\u00e2n\u0103 pentru aceast\u0103 gazd\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCa exemplu, vom analiza un eveniment. <i>Scanare de porturi.<\/i> de la gazda <i>10.201.3.149<\/i> pe <i>10.201.0.72<\/i>, f\u0103c\u00e2nd clic pe <i>Ac\u021biuni &gt; Fluxuri asociate<\/i>. Se ini\u021biaz\u0103 o c\u0103utare \u00een fluxuri \u0219i se afi\u0219eaz\u0103 informa\u021biile relevante.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 cum vedem, aceast\u0103 gazd\u0103 de la unul dintre porturile sale <i>51508\/TCP<\/i> a scanat acum 3 ore gazda de destina\u021bie pe porturile<i> 22, 28, 42, 41, 36, 40 (TCP).<\/i>Unele c\u00e2mpuri nu afi\u0219eaz\u0103 informa\u021bii fie pentru c\u0103 nu toate c\u00e2mpurile Netflow sunt suportate de exportatorul Netflow.<\/p>\n<h2>6. Analiza malware-ului desc\u0103rcat cu ajutorul CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 o analiz\u0103 cloud de la Cisco, care se integreaz\u0103 perfect cu Cisco StealthWatch \u0219i permite completarea analizei f\u0103r\u0103 semn\u0103tur\u0103 cu analiza bazat\u0103 pe semn\u0103turi. Astfel, devine posibil\u0103 detectarea troienilor, viermilor de re\u021bea, malware-urilor de tip zero-day \u0219i alte programe d\u0103un\u0103toare \u0219i propagarea acestora \u00een re\u021bea. De asemenea, tehnologia men\u021bionat\u0103 anterior ETA permite analizarea unor astfel de comunica\u021bii d\u0103un\u0103toare \u0219i \u00een traficul criptat.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nChiar pe prima tab a interfe\u021bei web exist\u0103 un widget special. <i>Cognitive Threat Analytics.<\/i>Un rezumat scurt arat\u0103 amenin\u021b\u0103rile detectate pe gazdele utilizatorilor: troian, malware fraudulent, adware nedorit. Cuv\u00e2ntul \u201eCriptat\u201d indic\u0103 de fapt activitatea ETA. F\u0103c\u00e2nd clic pe gazd\u0103, apare toat\u0103 informa\u021bia, inclusiv evenimentele de securitate \u0219i jurnalele de CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrec\u00e2nd cu mouse-ul peste fiecare etap\u0103 a CTA, evenimentele afi\u0219eaz\u0103 informa\u021bii detaliate despre interac\u021biune. Pentru o analiz\u0103 complet\u0103, ar trebui s\u0103 face\u021bi clic pe <i>Vizualiza\u021bi detaliile incidentului<\/i>, \u0219i ve\u021bi ajunge la o consol\u0103 separat\u0103. <i>Cognitive Threat Analytics.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen col\u021bul din dreapta sus, filtrul permite afi\u0219area evenimentelor dup\u0103 nivelul de criticitate. Trec\u00e2nd cu mouse-ul peste o anomalie specific\u0103, \u00een partea de jos a ecranului apar jurnalele cu un cronologie corespunz\u0103toare \u00een partea dreapt\u0103. Astfel, specialistul departamentului de securitate IT \u00een\u021belege clar care gazd\u0103 infectat\u0103 a \u00eenceput s\u0103 execute ce ac\u021biuni dup\u0103 ce a fost efectuat\u0103 o ac\u021biune.<\/p>\n<p>Mai jos este un alt exemplu \u2014 un troian bancar care a infectat gazda. <i>198.19.30.36<\/i>Aceast\u0103 gazd\u0103 a \u00eenceput s\u0103 interac\u021bioneze cu domenii d\u0103un\u0103toare, iar jurnalele afi\u0219eaz\u0103 informa\u021biile despre fluxurile acestor interac\u021biuni. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUna dintre cele mai bune solu\u021bii care poate fi, este izolarea serverului prin intermediul Cisco ISE. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">posibilitatea <\/a><\/noindex>pentru tratament \u0219i analiz\u0103 ulterioar\u0103. <\/p>\n<h2>Concluzie<\/h2>\n<p>\nSolu\u021bia Cisco StealthWatch este una dintre liderii \u00een produse de monitorizare a re\u021belei, at\u00e2t din punctul de vedere al analizei re\u021belei, c\u00e2t \u0219i al securit\u0103\u021bii informa\u021biilor. Datorit\u0103 acesteia, se pot detecta interac\u021biuni ilicite \u00een re\u021bea, \u00eent\u00e2rzieri ale aplica\u021biilor, utilizatorii cei mai activi, anomalii, malware \u0219i APT. \u00cen plus, este posibil s\u0103 identific\u0103m scan\u0103ri, pen-testeri \u0219i s\u0103 realiz\u0103m audituri criptografice ale traficului HTTPS. Pute\u021bi g\u0103si \u0219i mai multe cazuri de utilizare la <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">linkul<\/a><\/noindex>.<\/p>\n<p>Dac\u0103 dori\u021bi s\u0103 verifica\u021bi c\u00e2t de bine \u0219i eficient func\u021bioneaz\u0103 re\u021beaua dvs., trimite\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">o aplica\u021bie<\/a><\/noindex>. <br \/>\n\u00cen cur\u00e2nd, planific\u0103m \u00eenc\u0103 c\u00e2teva publica\u021bii tehnice pe diferite produse de securitate informa\u021bional\u0103. Dac\u0103 sunte\u021bi interesat de acest subiect, urm\u0103ri\u021bi actualiz\u0103rile pe canalele noastre (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogul TS Solution<\/a><\/noindex>)!<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: analiza \u0219i investigarea incidentelor. Partea 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}