{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> je analytick\u00e9 \u0159e\u0161en\u00ed v oblasti kybernetick\u00e9 bezpe\u010dnosti, kter\u00e9 poskytuje komplexn\u00ed monitorov\u00e1n\u00ed hrozeb v distribuovan\u00e9 s\u00edti. Z\u00e1kladem fungov\u00e1n\u00ed StealthWatch je sb\u011br dat NetFlow a IPFIX z router\u016f, switch\u016f a dal\u0161\u00edch s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed. V d\u016fsledku toho se s\u00ed\u0165 st\u00e1v\u00e1 citliv\u00fdm senzorem a umo\u017e\u0148uje administr\u00e1torovi nahl\u00e9dnout tam, kam tradi\u010dn\u00ed metody ochrany s\u00edt\u011b, nap\u0159\u00edklad firewally nov\u00e9 generace, nemohou.<\/p>\n<p>V p\u0159edchoz\u00edch \u010dl\u00e1nc\u00edch jsem ji\u017e psal o StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prvn\u00ed p\u0159edstaven\u00ed a mo\u017enosti<\/a><\/noindex>, ako aj <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">nasazen\u00ed a nastaven\u00ed<\/a><\/noindex>. Te\u010f navrhuji posunout se d\u00e1l a prodiskutovat, jak spr\u00e1vn\u011b pracovat s alarmy a vy\u0161et\u0159ovat bezpe\u010dnostn\u00ed incidenty, kter\u00e9 \u0159e\u0161en\u00ed generuje. Bude uvedeno 6 p\u0159\u00edklad\u016f, kter\u00e9, douf\u00e1m, poskytnou dobr\u00e9 p\u0159edstaven\u00ed u\u017eite\u010dnosti produktu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nNejprve je t\u0159eba \u0159\u00edci, \u017ee ve StealthWatch existuje ur\u010dit\u00e9 rozd\u011blen\u00ed alarm\u016f na algoritmy a feedy. Prvn\u00ed skupina zahrnuje r\u016fzn\u00e9 typy alarm\u016f (notifikac\u00ed), p\u0159i jejich\u017e spu\u0161t\u011bn\u00ed lze odhalit podez\u0159el\u00e9 aktivity v s\u00edti. Druh\u00e1 skupina se t\u00fdk\u00e1 bezpe\u010dnostn\u00edch incident\u016f. V tomto \u010dl\u00e1nku budou uvedeny 4 p\u0159\u00edklady alarm\u016f algoritm\u016f a 2 p\u0159\u00edklady feed\u016f.<\/p>\n<h2>1. Anal\u00fdza nejobjemn\u011bj\u0161\u00edch interakc\u00ed uvnit\u0159 s\u00edt\u011b<\/h2>\n<p>\nPo\u010d\u00e1te\u010dn\u00edm krokem nastaven\u00ed StealthWatch je ur\u010den\u00ed hostitel\u016f a s\u00edt\u00ed podle skupin. V webov\u00e9m rozhran\u00ed je z\u00e1lo\u017eka <i>Configure &gt; Host Group Management<\/i> , kde byste m\u011bli rozd\u011blit s\u00edt\u011b, hostitele a servery do odpov\u00eddaj\u00edc\u00edch skupin. Skupiny si m\u016f\u017eete vytv\u00e1\u0159et i sami. Mimochodem, anal\u00fdza interakc\u00ed mezi hostiteli v Cisco StealthWatch je velmi pohodln\u00e1, proto\u017ee nejen\u017ee m\u016f\u017eete ukl\u00e1dat filtry podle tok\u016f, ale tak\u00e9 samotn\u00e9 v\u00fdsledky.<\/p>\n<p>Nejprve je dobr\u00e9 v webov\u00e9m rozhran\u00ed p\u0159ej\u00edt na z\u00e1lo\u017eku <i>Analyze &gt; Flow Search<\/i>. Pot\u00e9 je t\u0159eba nastavit n\u00e1sleduj\u00edc\u00ed parametry:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (nejpopul\u00e1rn\u011bj\u0161\u00ed interakce)<\/li>\n<li>Time Range \u2014 24 hours (\u010dasov\u00e9 obdob\u00ed, m\u016f\u017eete pou\u017e\u00edt jin\u00e9)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (jak\u00fdkoli srozumiteln\u00fd n\u00e1zev)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (zdroj \u2014 skupina vnit\u0159n\u00edch uzl\u016f)<\/li>\n<li>Connection (m\u016f\u017eete uv\u00e9st porty, aplikace)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (c\u00edlov\u00e1 skupina \u2014 skupina vnit\u0159n\u00edch uzl\u016f)<\/li>\n<li>V Advanced Options m\u016f\u017eete nav\u00edc uv\u00e9st sb\u011bra\u010d, ze kter\u00e9ho se data prohl\u00ed\u017eej\u00ed, a \u0159azen\u00ed v\u00fdstupu (podle bajt\u016f, tok\u016f atd.). Nech\u00e1m to jako v\u00fdchoz\u00ed.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo stla\u010den\u00ed tla\u010didla <i>H\u013eada\u0165 <\/i>vyd\u00e1va zoznam interakci\u00ed, ktor\u00e9 s\u00fa u\u017e usporiadan\u00e9 pod\u013ea objemu prenesen\u00fdch d\u00e1t.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV mojom pr\u00edklade je hos\u0165 <i>10.150.1.201<\/i> (server) v r\u00e1mci jedn\u00e9ho pr\u00fadu preniesol<i> 1.5 GB<\/i> d\u00e1ta na hos\u0165 <i>10.150.1.200<\/i> (klient) prostredn\u00edctvom protokolu <i>mysql<\/i>. Tla\u010didlo <i>Manage Columns<\/i> umo\u017e\u0148uje prida\u0165 viac st\u013apcov do zobrazovan\u00fdch d\u00e1t.<\/p>\n<p>N\u00e1sledne m\u00f4\u017ee administr\u00e1tor pod\u013ea uv\u00e1\u017eenia vytvori\u0165 vlastn\u00e9 pravidlo, ktor\u00e9 bude st\u00e1le spusten\u00e9 na tento druh interakci\u00ed a upozor\u0148ova\u0165 prostredn\u00edctvom SNMP, emailu alebo Syslog. <\/p>\n<h2>2. Anal\u00fdza najpomal\u0161\u00edch klient-server interakci\u00ed v sieti z h\u013eadiska oneskorenia<\/h2>\n<p>\n\u0160t\u00edtky <b>SRT (Server Response Time)<\/b>, <b>RTT (Round Trip Time)<\/b> umo\u017e\u0148uj\u00fa zisti\u0165 oneskorenia serverov a celkov\u00e9 oneskorenie v sieti. Tento n\u00e1stroj je obzvl\u00e1\u0161\u0165 u\u017eito\u010dn\u00fd, ke\u010f je potrebn\u00e9 r\u00fdchlo n\u00e1js\u0165 d\u00f4vod s\u0165a\u017enost\u00ed pou\u017e\u00edvate\u013eov na pomaly funguj\u00facu aplik\u00e1ciu.<\/p>\n<p><i>Pozn\u00e1mka<\/i>: takmer v\u0161etci Netflow export\u00e9ri <b>nedok\u00e1\u017eu<\/b> posielaj\u00fa zna\u010dky SRT, RTT, preto je \u010dasto potrebn\u00e9 nastavi\u0165 odosielanie k\u00f3pie prenosu z sie\u0165ov\u00fdch zariaden\u00ed, aby sme tieto d\u00e1ta videli na FlowSensor. FlowSensor na opl\u00e1tku poskytuje roz\u0161\u00edren\u00fd IPFIX na FlowCollector.<\/p>\n<p>T\u00fato analytiku je pohodlnej\u0161ie vykon\u00e1va\u0165 v java aplik\u00e1cii StealthWatch, ktor\u00e1 sa in\u0161taluje na po\u010d\u00edta\u010d administr\u00e1tora.<\/p>\n<p>Prav\u00fdm tla\u010didlom my\u0161i na <i>Inside Hosts<\/i> prech\u00e1dzame na kartu <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlikneme na <i>Filter <\/i>a nastav\u00edme potrebn\u00e9 parametre. Ako pr\u00edklad:<\/p>\n<ul>\n<li>D\u00e1tum\/\u010cas \u2014 Za posledn\u00e9 3 dni<\/li>\n<li>V\u00fdkon \u2014 Priemern\u00fd Round Trip Time &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo zobrazen\u00ed \u00fadajov je potrebn\u00e9 prida\u0165 zauj\u00edmav\u00e9 RTT, SRT polia. Na to je potrebn\u00e9 klikn\u00fa\u0165 na st\u013apec na sn\u00edmke obrazovky a prav\u00fdm tla\u010didlom my\u0161i vybra\u0165 <i>Manage Columns<\/i>. Potom kliknite na parametre RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo spracovan\u00ed po\u017eiadavky som triedil pod\u013ea priemern\u00e9ho RTT a videl najpomal\u0161ie interakcie.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAby ste sa dostali do podrobnej\u0161\u00edch inform\u00e1ci\u00ed, kliknite prav\u00fdm tla\u010didlom my\u0161i na pr\u00fad a vyberte <i>Quick View for Flow<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTieto inform\u00e1cie nazna\u010duj\u00fa, \u017ee hos\u0165 <i>10.201.3.59<\/i> z skupiny <i>Sales and Marketing<\/i> prostredn\u00edctvom protokolu <i>NFS<\/i> odkazuje na <i>DNS serveru<\/i> po\u010das jednej min\u00faty a 23 sek\u00fand a m\u00e1 hrozn\u00e9 oneskorenie. Na karte <i>Interfaces <\/i>m\u00f4\u017eete zisti\u0165, z ktor\u00e9ho Netflow export\u00e9ra boli inform\u00e1cie z\u00edskan\u00e9. Na karte <i>Table <\/i> je zobrazen\u00e1 podrobnej\u0161ia inform\u00e1cia o interakcii.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e1sledne je potrebn\u00e9 zisti\u0165, ktor\u00e9 zariadenia posielaj\u00fa d\u00e1ta na FlowSensor a probl\u00e9m by pravdepodobne mohol by\u0165 tam.<\/p>\n<p>Navy\u0161e, StealthWatch je jedine\u010dn\u00fd t\u00fdm, \u017ee vykon\u00e1va <b>deduplik\u00e1ciu<\/b> d\u00e1t (sp\u00e1ja rovnak\u00e9 toky). Preto je mo\u017en\u00e9 zbiera\u0165 prakticky zo v\u0161etk\u00fdch zariaden\u00ed Netflow a nebojte sa, \u017ee bude ve\u013ea duplicitn\u00fdch d\u00e1t. Naopak, v tejto sch\u00e9me to pom\u00f4\u017ee pochopi\u0165, na ktorom presne hopsk\u00fdch miestach s\u00fa najv\u00e4\u010d\u0161ie zdr\u017eania.<\/p>\n<h2>3. Audit kryptografick\u00fdch protokolov HTTPS<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> \u2014 technol\u00f3gia vyvinut\u00e1 spolo\u010dnos\u0165ou Cisco, ktor\u00e1 umo\u017e\u0148uje zisti\u0165 \u0161kodliv\u00e9 pripojenia v za\u0161ifrovanom prevode bez jeho de\u0161ifrovania. Navy\u0161e, t\u00e1to technol\u00f3gia umo\u017e\u0148uje \u201erozobera\u0165\u201c HTTPS na verzie TLS a kryptografick\u00e9 protokoly, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa pri pripojeniach. T\u00e1to funkcia je obzvl\u00e1\u0161\u0165 u\u017eito\u010dn\u00e1, ke\u010f je potrebn\u00e9 zisti\u0165 sie\u0165ov\u00e9 uzly, ktor\u00e9 pou\u017e\u00edvaj\u00fa slab\u00e9 kryptostandardy.<\/p>\n<p><i>Pozn\u00e1mka<\/i>: predt\u00fdm je potrebn\u00e9 nain\u0161talova\u0165 network app na StealthWatch \u2014 <b>ETA Kryptografick\u00fd Audit<\/b>.<\/p>\n<p>Prejdeme na kartu <i>Dashboards \u2192 ETA Kryptografick\u00fd Audit<\/i> a vyberieme skupinu hostite\u013eov, ktor\u00fa pl\u00e1nujeme analyzova\u0165. Pre celkov\u00fd obraz vyberieme <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00f4\u017eeme pozorova\u0165, \u017ee sa zobrazuj\u00fa verzia TLS a pr\u00edslu\u0161n\u00fd kryptostandard. Pod\u013ea zvy\u010dajnej sch\u00e9my v st\u013apci <i>Akcie <\/i>prech\u00e1dzame do <i>View Flows<\/i> a vyh\u013ead\u00e1vanie sa spust\u00ed v novom okne.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZ v\u00fdstupu je jasn\u00e9, \u017ee hostite\u013e <i>198.19.20.136<\/i> po\u010das <i>12 hod\u00edn<\/i> pou\u017e\u00edval HTTPS s TLS 1.2, kde algoritmus \u0161ifrovania <i>AES-256<\/i> a hashovacia funkcia <i>SHA-384<\/i>. Tak\u017ee, ETA umo\u017e\u0148uje n\u00e1js\u0165 slab\u00e9 algoritmy v sieti.<\/p>\n<h2>4. Anal\u00fdza anom\u00e1li\u00ed v sieti<\/h2>\n<p>\nCisco StealthWatch m\u00e1 schopnos\u0165 rozpozn\u00e1va\u0165 anom\u00e1lie prenosu v sieti, vyu\u017e\u00edvaj\u00fac tri n\u00e1stroje: <b>Core Events<\/b> (bezpe\u010dnostn\u00e9 udalosti), <b>Relationship Events<\/b> (udalosti interakci\u00ed medzi segmentami, uzlami siete) a <b>behavior\u00e1lnu anal\u00fdzu<\/b>.<\/p>\n<p>Behavior\u00e1lna anal\u00fdza, na druhej strane, umo\u017e\u0148uje v priebehu \u010dasu vytv\u00e1ra\u0165 model spr\u00e1vania ur\u010dit\u00e9ho hostite\u013ea alebo skupiny hostite\u013eov. \u010c\u00edm viac prenosu prech\u00e1dza cez StealthWatch, t\u00fdm presnej\u0161ie bud\u00fa sp\u00fa\u0161\u0165ania v\u010faka tejto anal\u00fdze. Na za\u010diatku syst\u00e9m mnohokr\u00e1t chybne sp\u00fa\u0161\u0165a, preto je potrebn\u00e9 \u201edoladi\u0165\u201c pravidl\u00e1 manu\u00e1lne. Odpor\u00fa\u010dam prv\u00e9 nieko\u013eko t\u00fd\u017ed\u0148ov nevenova\u0165 pozornos\u0165 tak\u00fdm udalostiam, preto\u017ee sa syst\u00e9m s\u00e1m prisp\u00f4sob\u00ed, alebo ich prid\u00e1va\u0165 medzi v\u00fdnimky.<\/p>\n<p>Ni\u017e\u0161ie je uveden\u00fd pr\u00edklad prednastaven\u00e9ho pravidla <i>Anomaly<\/i>, v ktorom sa uv\u00e1dza, \u017ee udalos\u0165 sa aktivuje bez alarmu, ak <i>hostite\u013e v skupine Inside Hosts komunikuje so skupinou Inside Hosts a za 24 hod\u00edn prenos presiahne 10 megabajtov.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPre pr\u00edklad vezmeme alarm <i>Data Hoarding<\/i>, \u010do znamen\u00e1, \u017ee nejak\u00fd zdrojov\u00fd\/cie\u013eov\u00fd hostite\u013e stiahnu\/vytiahol anom\u00e1lne ve\u013ek\u00e9 mno\u017estvo d\u00e1t z skupiny hostite\u013eov alebo hostite\u013ea. Klikneme na udalos\u0165 a prejdeme do tabu\u013eky, kde s\u00fa uveden\u00ed hostitelia sp\u00fa\u0161\u0165aj\u00faci udalos\u0165. Potom vyberieme hostite\u013ea, ktor\u00fd n\u00e1s zauj\u00edma, v st\u013apci <i>Data Hoarding<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZobraz\u00ed sa udalos\u0165, ktor\u00e1 hovor\u00ed o tom, \u017ee sa zistili 162k \u201ebodov\u201c, pri\u010dom pod\u013ea politiky je povolen\u00fdch 100k \u201ebodov\u201c \u2014 to s\u00fa vn\u00fatorn\u00e9 metriky StealthWatch. V st\u013apci <i>Akcie <\/i>klikneme na <i>View Flows<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00f4\u017eeme pozorova\u0165, \u017ee <i>tento hostite\u013e<\/i> v noci komunikoval s hostite\u013eom <i>10.201.3.47<\/i> z oddelenia <i>Sales &amp; Marketing<\/i> prostredn\u00edctvom protokolu <i>HTTPS <\/i>a stiahol <i>1.4 GB<\/i>. Mo\u017eno tento pr\u00edklad nie je \u00faplne \u0161\u0165astn\u00fd, ale detekcia interakci\u00ed aj na nieko\u013eko stoviek gigabajtov sa vykon\u00e1va presne rovnak\u00fdm sp\u00f4sobom. Preto \u010fal\u0161ie vy\u0161etrovanie anom\u00e1li\u00ed m\u00f4\u017ee vies\u0165 k zauj\u00edmav\u00fdm v\u00fdsledkom.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Pozn\u00e1mka<\/i>: vo webovom rozhran\u00ed SMC s\u00fa d\u00e1ta vo z\u00e1lo\u017ek\u00e1ch <i>Dashboards <\/i>zobrazen\u00e9 iba za posledn\u00fd t\u00fd\u017ede\u0148 a vo z\u00e1lo\u017eke <i>Monitor<\/i> za posledn\u00e9 2 t\u00fd\u017edne. Ak chcete analyzova\u0165 udalosti star\u0161ieho d\u00e1ta a generova\u0165 spr\u00e1vy, je potrebn\u00e9 pracova\u0165 s java konzolou na po\u010d\u00edta\u010di administr\u00e1tora.<\/p>\n<h2>5. N\u00e1jdenie vn\u00fatorn\u00fdch skenovan\u00ed siete<\/h2>\n<p>\nTeraz si pozrime nieko\u013eko pr\u00edkladov feedov \u2014 incidentov IT bezpe\u010dnosti. T\u00e1to funkcia je zauj\u00edmav\u00e1 viac pre bezpe\u010dnostn\u00fdch odborn\u00edkov.<\/p>\n<p>Prednastaven\u00fdch typov skenovac\u00edch udalost\u00ed v StealthWatch je nieko\u013eko:<\/p>\n<ul>\n<li>Port Scan \u2014 zdroj skenuje mno\u017estvo portov cie\u013eov\u00e9ho uzla.<\/li>\n<li>Addr tcp scan \u2014 zdroj skenuje cel\u00fa sie\u0165 po jednom a tom istom TCP porte, pri\u010dom men\u00ed IP adresu cie\u013ea. Pri tom zdroj dost\u00e1va TCP Reset pakety alebo v\u00f4bec nedost\u00e1va odpovede.<\/li>\n<li>Addr udp scan \u2014 zdroj skenuje cel\u00fa sie\u0165 po jednom a tom istom UDP porte, pri\u010dom men\u00ed IP adresu cie\u013ea. Pri tom zdroj dost\u00e1va ICMP Port Unreachable pakety alebo v\u00f4bec nedost\u00e1va odpovede.<\/li>\n<li>Ping Scan \u2014 zdroj posiela ICMP dotazy na cel\u00fa sie\u0165 s cie\u013eom vyh\u013ead\u00e1va\u0165 odpovede.<\/li>\n<li>Stealth Scan tcp\/udp \u2014 zdroj pou\u017eil ten ist\u00fd svoj port na pripojenie k mnoh\u00fdm portom na cie\u013eovom uzle v rovnakom \u010dase.<\/li>\n<\/ul>\n<p>\nPre pohodlnej\u0161ie n\u00e1jdenie v\u0161etk\u00fdch vn\u00fatorn\u00fdch skenerov existuje aplik\u00e1cia network pre <i>StealthWatch \u2014 Visibility Assessment<\/i>. Prejdite do z\u00e1lo\u017eky <i>Dashboards \u2192 Visibility Assessment \u2192 Internal Network Scanners<\/i> uvid\u00edte bezpe\u010dnostn\u00e9 incidenty t\u00fdkaj\u00face sa skenovania za posledn\u00e9 2 t\u00fd\u017edne.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKliknut\u00edm na tla\u010didlo <i>Details<\/i>, bude vidno za\u010diatok skenovania ka\u017edej siete, trend prenosu a pr\u00edslu\u0161n\u00e9 alarmy.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010ealej sa m\u00f4\u017eete 'prebali\u0165' do hostite\u013ea z karty na predch\u00e1dzaj\u00facom sn\u00edmku a vidie\u0165 bezpe\u010dnostn\u00e9 udalosti, ako aj aktivitu za posledn\u00fd t\u00fd\u017ede\u0148 pre tento hostite\u013e.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko pr\u00edklad analyzujeme udalos\u0165 <i>Port Scan<\/i> z hostite\u013ea <i>10.201.3.149<\/i> na <i>10.201.0.72<\/i>, kliknut\u00edm na <i>Actions &gt; Associated Flows<\/i>. Za\u010d\u00edna sa vyh\u013ead\u00e1vanie pod\u013ea tokov a zobrazia sa relevantn\u00e9 inform\u00e1cie.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko vid\u00edme, tento hostite\u013e z jedn\u00e9ho svojho portu <i>51508\/TCP<\/i> skanoval pred 3 hodinami cie\u013eov\u00fd hostite\u013e na portoch<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. Niektor\u00e9 polia nezobrazuj\u00fa inform\u00e1cie, bu\u010f preto, \u017ee nie v\u0161etky polia Netflow s\u00fa podporovan\u00e9 na Netflow export\u00e9ri.<\/p>\n<h2>6. Anal\u00fdza stiahnut\u00fdch zlovredov pomocou CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 cloudov\u00e1 analytika Cisco, ktor\u00e1 sa v\u00fdborne integruje s Cisco StealthWatch a umo\u017e\u0148uje doplni\u0165 bezs\u00faborov\u00fa anal\u00fdzu o anal\u00fdzu so s\u00fabormi. T\u00fdmto sa st\u00e1va mo\u017en\u00e9 detekovanie trojansk\u00fdch kon\u00ed, sie\u0165ov\u00fdch \u010dervov, zlovredn\u00e9ho softv\u00e9ru nult\u00e9ho d\u0148a a in\u00fdch zlovredov a ich \u0161\u00edrenie v r\u00e1mci siete. Okrem toho predt\u00fdm spomenut\u00e1 technol\u00f3gia ETA umo\u017e\u0148uje analyzova\u0165 tak\u00e9 zlovredn\u00e9 komunik\u00e1cie aj v za\u0161ifrovanom prenosu.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa prvej z\u00e1lo\u017eke vo webovom rozhran\u00ed je \u0161peci\u00e1lny widget <i>Cognitive Threat Analytics<\/i>. Kr\u00e1tke zhrnutie hovor\u00ed o zisten\u00fdch hrozb\u00e1ch na pou\u017e\u00edvate\u013esk\u00fdch hostite\u013eoch: trojan, podvodn\u00fd softv\u00e9r, ob\u0165a\u017euj\u00faci reklamn\u00fd softv\u00e9r. Slovo 'Encrypted' presne nazna\u010duje fungovanie ETA. Kliknut\u00edm na hostite\u013ea sa zobraz\u00ed v\u0161etko, vr\u00e1tane inform\u00e1ci\u00ed a bezpe\u010dnostn\u00fdch udalost\u00ed, ako aj protokoly k CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa ka\u017edom kroku CTA sa zobrazuj\u00fa podrobn\u00e9 inform\u00e1cie o interakci\u00e1ch. Pre \u00fapln\u00fa anal\u00fdzu kliknite na <i>View Incident Details<\/i>, dostanete sa do samostatnej konzoly. <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV pravom hornom rohu filtr umo\u017e\u0148uje zobrazi\u0165 ud\u00e1losti pod\u013ea \u00farovne kritickosti. Po najet\u00ed na konkr\u00e9tnu anom\u00e1liu sa v dolnej \u010dasti obrazovky zobrazia protokoly s pr\u00edslu\u0161n\u00fdm \u010dasov\u00fdm rozl\u00ed\u0161en\u00edm sprava. T\u00fdmto m\u00e1 odborn\u00edk na informa\u010dn\u00fa bezpe\u010dnos\u0165 jasn\u00fa predstavu o tom, ktor\u00fd infikovan\u00fd hostite\u013e po ak\u00fdch akci\u00e1ch za\u010dal vykon\u00e1va\u0165 ak\u00e9 \u010dinnosti.<\/p>\n<p>Ni\u017e\u0161ie je zn\u00e1zornen\u00fd \u010fal\u0161\u00ed pr\u00edklad \u2013 bankov\u00fd trojan, ktor\u00fdm bol infikovan\u00fd hostite\u013e <i>198.19.30.36<\/i>. Tento hostite\u013e za\u010dal interagova\u0165 so zlovredn\u00fdmi dom\u00e9nami a v protokoloch je zobrazen\u00e1 inform\u00e1cia o tokoch t\u00fdchto interakci\u00ed. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010ealej jedno z najlep\u0161\u00edch rie\u0161en\u00ed, ktor\u00e9 m\u00f4\u017ee by\u0165, je umiestni\u0165 hostite\u013ea do karant\u00e9ny pomocou nativnej <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integr\u00e1cie <\/a><\/noindex>s Cisco ISE na \u010fal\u0161iu lie\u010dbu a anal\u00fdzu. <\/p>\n<h2>Z\u00e1ver<\/h2>\n<p>\nRie\u0161enie Cisco StealthWatch je jedn\u00fdm z l\u00eddrov medzi produktmi na monitorovanie siete, pokia\u013e ide o anal\u00fdzu siete aj informa\u010dn\u00fa bezpe\u010dnos\u0165. Umo\u017e\u0148uje odha\u013eova\u0165 nelegit\u00edmne interakcie v sieti, oneskorenia aplik\u00e1ci\u00ed, najakt\u00edvnej\u0161\u00edch pou\u017e\u00edvate\u013eov, anom\u00e1lie, malware a APT. Okrem toho je mo\u017en\u00e9 zis\u0165ova\u0165 skenovania, penetra\u010dn\u00e9 testy a vykon\u00e1va\u0165 kryptoaudit HTTPS prev\u00e1dzky. E\u0161te viac pr\u00edpadov pou\u017eitia n\u00e1jdete na <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">odkaze<\/a><\/noindex>.<\/p>\n<p>Ak m\u00e1te chu\u0165 skontrolova\u0165, ako hladko a efekt\u00edvne va\u0161a sie\u0165 funguje, po\u0161lite <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">\u017eiados\u0165<\/a><\/noindex>. <br \/>\nV najbli\u017e\u0161ej dobe pl\u00e1nujeme \u010fal\u0161ie technick\u00e9 publik\u00e1cie o r\u00f4znych produktoch IB. Ak v\u00e1s t\u00e1to tematika zauj\u00edma, sledujte na\u0161e aktualiz\u00e1cie na kan\u00e1loch (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blog TS Solution<\/a><\/noindex>)!<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: anal\u00fdza a vy\u0161etrovanie incidentov. \u010cas\u0165 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}