{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: analiza in preiskava incidentov. Del 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> \u2014 je analiti\u010dno re\u0161itev na podro\u010dju varnosti informacij, ki zagotavlja celovit nadzor nad gro\u017enjami v razdeljeni omre\u017eju. Osnova delovanja StealthWatch je zbiranje NetFlow in IPFIX z usmerjevalnikov, stikal in drugih omre\u017enih naprav. Tako postane omre\u017eje ob\u010dutljiv senzor in omogo\u010da administratorju, da vpogleda tja, kjer tradicionalne metode za\u0161\u010dite omre\u017eja, na primer Next Generation Firewall, ne morejo priti.<\/p>\n<p>V prej\u0161njih \u010dlankih sem \u017ee pisal o StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prvo predstavitev in mo\u017enosti<\/a><\/noindex>, kao i <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">namestitev in nastavitev<\/a><\/noindex>. Zdaj vam predlagam, da gremo naprej in razpravljamo, kako pravilno delati z alarmi in raziskovati varnostne incidente, ki jih generira re\u0161itev. Predstavil bom 6 primerov, za katere upam, da bodo dali dober pregled o uporabnosti izdelka.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nNajprej je treba omeniti, da StealthWatch vsebuje dolo\u010deno razporeditev spro\u017eitev na algoritme in vire. Prvi so razli\u010dni alarmi (obvestila), ob spro\u017eitvi katerih lahko odkrijemo sumljive stvari v omre\u017eju. Drugi so varnostni inci-denti. V tem \u010dlanku bomo obravnavali 4 primere spro\u017eitev algoritmov in 2 primera virov.<\/p>\n<h2>1. Analiza najve\u010djih interakcij znotraj omre\u017eja<\/h2>\n<p>\nPrvi korak pri nastavitvi StealthWatch je dolo\u010ditev gostiteljev in omre\u017eij po skupinah. V spletni vmesnik na zavihku <i>Configure &gt; Host Group Management<\/i> je treba razdeliti omre\u017eja, gostitelje, stre\u017enike po ustreznih skupinah. Skupine je mogo\u010de ustvariti tudi sami. Mimogrede, analiza interakcij med gostitelji v Cisco StealthWatch je precej priro\u010dna, saj lahko ne le shranjujete iskalne filtre po tokovih, ampak tudi rezultate.<\/p>\n<p>Najprej se v spletni vmesnik vstopi na zavihek <i>Analyze &gt; Flow Search<\/i>. Nato je treba nastaviti naslednje parametre:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (najbolj priljubljene interakcije)<\/li>\n<li>Time Range \u2014 24 hours (\u010dasovno obdobje, lahko uporabite tudi drugo)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (poljubno razumljivo ime)<\/li>\n<li>Subject \u2014 Host Groups \u2192 Inside Hosts (vir \u2014 skupina notranjih gostiteljev)<\/li>\n<li>Connection (lahko navedete porte, aplikacije)<\/li>\n<li>Peer \u2014 Host Groups \u2192 Inside Hosts (namen \u2014 skupina notranjih gostiteljev)<\/li>\n<li>V naprednih mo\u017enostih lahko dodatno navedete zbiralnik, iz katerega se gledajo podatki, razvrstitev izhoda (po bajtih, tokovih in drugo). Pustil bom privzeto.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo pritisku na gumb <i>I\u0161samiai <\/i>\u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u043e\u0442\u0441\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e \u043e\u0431\u044a\u0435\u043c\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0412 \u043c\u043e\u0435\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0445\u043e\u0441\u0442 <i>10.150.1.201<\/i> (\u0441\u0435\u0440\u0432\u0435\u0440) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u043b<i> 1.5 GB<\/i> \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442 <i>10.150.1.200<\/i> (\u043a\u043b\u0438\u0435\u043d\u0442) \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443 <i>mysql<\/i>. \u041a\u043d\u043e\u043f\u043a\u0430 <i>\u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0442\u043e\u043b\u0431\u0446\u0430\u043c\u0438<\/i> \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u0442\u043e\u043b\u0431\u0446\u043e\u0432 \u0432 \u0432\u044b\u0432\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435.<\/p>\n<p>\u0414\u0430\u043b\u0435\u0435 \u043f\u043e \u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0438\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043a\u0430\u0441\u0442\u043e\u043c\u043d\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u043d\u0430 \u0442\u0430\u043a\u043e\u0433\u043e \u0440\u043e\u0434\u0430 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u044f\u0442\u044c \u043f\u043e SNMP, email \u0438\u043b\u0438 Syslog. <\/p>\n<h2>2. \u0410\u043d\u0430\u043b\u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u043c\u0435\u0434\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442-\u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0442\u0438 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0437\u0430\u0434\u0435\u0440\u0436\u0435\u043a<\/h2>\n<p>\nOznake <b>SRT (\u0412\u0440\u0435\u043c\u044f \u043e\u0442\u0432\u0435\u0442\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430)<\/b>, <b>RTT (\u0412\u0440\u0435\u043c\u044f \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438)<\/b> \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043e\u0431\u0449\u0438\u0435 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0432 \u0441\u0435\u0442\u0438. \u0414\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0443\u0434\u043e\u0431\u0435\u043d, \u043a\u043e\u0433\u0434\u0430 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0431\u044b\u0441\u0442\u0440\u043e \u043d\u0430\u0439\u0442\u0438 \u043f\u0440\u0438\u0447\u0438\u043d\u0443 \u0436\u0430\u043b\u043e\u0431 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435.<\/p>\n<p><i>Napomena<\/i>: \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u044d\u043a\u0441\u043f\u043e\u0440\u0442\u0435\u0440\u044b Netflow <b>ne znata<\/b> \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u043c\u0435\u0442\u043a\u0438 SRT, RTT, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u0430\u0447\u0430\u0441\u0442\u0443\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 FlowSensor \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043a\u043e\u043f\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. FlowSensor, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u043e\u0442\u0434\u0430\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 IPFIX \u043d\u0430 FlowCollector.<\/p>\n<p>\u0414\u0430\u043d\u043d\u0443\u044e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0443 \u0443\u0434\u043e\u0431\u043d\u0435\u0435 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 StealthWatch, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.<\/p>\n<p>\u041f\u0440\u0430\u0432\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0448\u0435\u0439 \u043c\u044b\u0448\u0438 \u043d\u0430 <i>Inside Hosts<\/i> \u0438 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043c \u0432\u043e \u0432\u043a\u043b\u0430\u0434\u043a\u0443 <i>\u0422\u0430\u0431\u043b\u0438\u0446\u0430 \u043f\u043e\u0442\u043e\u043a\u043e\u0432<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041d\u0430\u0436\u0438\u043c\u0430\u0435\u043c \u043d\u0430 <i>Filter <\/i>\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430:<\/p>\n<ul>\n<li>\u0414\u0430\u0442\u0430\/\u0412\u0440\u0435\u043c\u044f \u2014 \u0417\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 3 \u0434\u043d\u044f<\/li>\n<li>\u041f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u2014 \u0421\u0440\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041f\u043e\u0441\u043b\u0435 \u0432\u044b\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0449\u0438\u0435 \u043d\u0430\u0441 \u043f\u043e\u043b\u044f RTT, SRT. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u0436\u043c\u0438\u0442\u0435 \u043d\u0430 \u043a\u043e\u043b\u043e\u043d\u043a\u0443 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0438 \u043f\u0440\u0430\u0432\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0448\u0435\u0439 \u043c\u044b\u0448\u0438 \u0432\u044b\u0431\u0435\u0440\u0438\u0442\u0435 <i>\u0423\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0442\u043e\u043b\u0431\u0446\u0430\u043c\u0438<\/i>. \u0414\u0430\u043b\u0435\u0435 \u0432\u044b\u0431\u0435\u0440\u0438\u0442\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u044f \u043e\u0442\u0441\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b \u043f\u043e \u0441\u0440\u0435\u0434\u043d\u0435\u043c\u0443 RTT \u0438 \u0443\u0432\u0438\u0434\u0435\u043b \u0441\u0430\u043c\u044b\u0435 \u043c\u0435\u0434\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0427\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043d\u0430\u0436\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u043e\u0439 \u043a\u043b\u0430\u0432\u0438\u0448\u0435\u0439 \u043c\u044b\u0448\u0438 \u043d\u0430 \u043f\u043e\u0442\u043e\u043a \u0438 \u0432\u044b\u0431\u0440\u0430\u0442\u044c <i>\u0411\u044b\u0441\u0442\u0440\u044b\u0439 \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440 \u043f\u043e\u0442\u043e\u043a\u0430<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0414\u0430\u043d\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0445\u043e\u0441\u0442 <i>10.201.3.59<\/i> \u0438\u0437 \u0433\u0440\u0443\u043f\u043f\u044b <i>\u041f\u0440\u043e\u0434\u0430\u0436\u0438 \u0438 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433<\/i> putem protokola <i>NFS<\/i> calls <i>DNS \u0441\u0435\u0440\u0432\u0435\u0440\u0443<\/i> \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0434\u043d\u043e\u0439 \u043c\u0438\u043d\u0443\u0442\u044b \u0438 23 \u0441\u0435\u043a\u0443\u043d\u0434 \u0438 \u0438\u043c\u0435\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u043e \u0443\u0436\u0430\u0441\u043d\u0443\u044e \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0443. \u0412\u043e \u0432\u043a\u043b\u0430\u0434\u043a\u0435 <i>Vmesniki <\/i>\u043c\u043e\u0436\u043d\u043e \u0443\u0437\u043d\u0430\u0442\u044c, \u0441 \u043a\u0430\u043a\u043e\u0433\u043e Netflow \u044d\u043a\u0441\u043f\u043e\u0440\u0442\u0435\u0440\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u0434\u0430\u043d\u043d\u044b\u0435. \u0412\u043e \u0432\u043a\u043b\u0430\u0434\u043a\u0435 <i>\u0422\u0430\u0431\u043b\u0438\u0446\u0430 <\/i> \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0430 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0414\u0430\u043b\u0435\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u0437\u043d\u0430\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 FlowSensor, \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0442\u0430\u043c.<\/p>\n<p>\u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, StealthWatch \u0443\u043d\u0438\u043a\u0430\u043b\u0435\u043d \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 <b>\u0434\u0435\u0434\u0443\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u044e<\/b> podatkih (zdru\u017euje iste tokove). Zato lahko zbiramo prakti\u010dno iz vseh naprav Netflow in se ne bojimo, da bi bilo veliko ponavljajo\u010dih se podatkov. Prav nasprotno, ta shema pomaga razumeti, na katerem hopu so najve\u010dje zamude.<\/p>\n<h2>3. Revizija kriptografskih protokolov HTTPS<\/h2>\n<p>\n<b>ETA (Encrypted Traffic Analytics)<\/b> \u2014 tehnologija, razvita pri Cisco, ki omogo\u010da odkrivanje zlonamernih povezav v \u0161ifriranem prometu brez njegove de\u0161ifriranja. Poleg tega ta tehnologija omogo\u010da \u201erazbitje\u201c HTTPS na razli\u010dice TLS in kriptografske protokole, ki se uporabljajo pri povezavah. Ta funkcionalnost je \u0161e posebej uporabna, kadar je treba odkriti omre\u017ene vozli\u0161\u010da, ki uporabljajo \u0161ibke kripto standarde.<\/p>\n<p><i>Napomena<\/i>: predhodno je potrebno namestiti network app na StealthWatch \u2014 <b>ETA kriptografska revizija<\/b>.<\/p>\n<p>Prelazimo na karticu <i>Dashboards \u2192 ETA kriptografska revizija<\/i> in izberemo skupino gostiteljev, ki jo nameravamo analizirati. Za celotno sliko izberimo <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLahko opazujemo, da so prikazane razli\u010dica TLS in ustrezen kriptografski standard. Po obi\u010dajni shemi v stolpcu <i>Akcije <\/i>se premaknemo v <i>View Flows<\/i> in se za\u017eene iskanje v novem zavihku.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIz izpisa je razvidno, da je gostitelj <i>198.19.20.136<\/i> v \u010dasu <i>12 ur<\/i> uporabil HTTPS s TLS 1.2, kjer je algoritem \u0161ifriranja <i>AES-256<\/i> in hash funkcija <i>SHA-384<\/i>. Tako ETA omogo\u010da odkrivanje \u0161ibkih algoritmov v omre\u017eju.<\/p>\n<h2>4. Analiza anomalij v omre\u017eju<\/h2>\n<p>\nCisco StealthWatch zna prepoznati anomalije prometa v omre\u017eju z uporabo treh orodij: <b>Core Events<\/b> (varnostni dogodki), <b>Relationship Events<\/b> (dogodki interakcij med segmenti, vozli\u0161\u010di omre\u017eja) in <b>analiza vedenja<\/b>.<\/p>\n<p>Analiza vedenja pa s\u010dasoma omogo\u010da gradnjo modela obna\u0161anja dolo\u010denega gostitelja ali skupine gostiteljev. Ve\u010d prometa, ki mine skozi StealthWatch, bolj natan\u010dna bodo aktiviranja zahvaljujo\u010d tej analizi. Sprva sistem pogosto napa\u010dno spro\u017ei, zato je potrebno pravila \u201eprilagoditi\u201c ro\u010dno. Priporo\u010dam, da v prvih nekaj tednih ne posve\u010date pozornosti takim dogodkom, saj se bo sistem sam prilagodil, ali pa jih dodajte v izklju\u010ditve.<\/p>\n<p>Spodaj je primer vnaprej nastavljenega pravila <i>Anomaly<\/i>, v katerem je navedeno, da se bo dogodek spro\u017eil brez alarma, \u010de <i>gostitelj v skupini Inside Hosts komunicira s skupino Inside Hosts in v 24 urah promet prese\u017ee 10 megabajtov.<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZa primer vzemimo alarm <i>Data Hoarding<\/i>, kar pomeni, da je nek vir\/destinacija prenesel\/izvlekel nenormalno veliko koli\u010dino podatkov z ene skupine gostiteljev ali gostitelja. Kliknemo na dogodek in se preusmerimo na tabelo, kjer so navedeni spro\u017eilni gostitelji. Nato izberemo gostitelja, ki nas zanima, v stolpcu <i>Data Hoarding<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrika\u017ee se dogodek, ki govori o tem, da je bilo odkrito 162k 'to\u010dk', medtem ko je po politiki dovoljeno 100k 'to\u010dk' \u2014 to so notranje metrike StealthWatch. V stolpcu <i>Akcije <\/i>\u043d\u0430\u0436\u0438\u043c\u0430\u0435\u043c <i>View Flows<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLahko opazimo, da <i>ta gostitelj<\/i> je pono\u010di komuniciral z gostiteljem <i>10.201.3.47<\/i> iz oddelka <i>Prodaja in marketing<\/i> putem protokola <i>HTTPS <\/i>in prenesel je <i>1.4 GB<\/i>. Morda ta primer ni povsem ustrezen, vendar se detekcija interakcij tudi za ve\u010d sto gigabajtov izvaja na enak na\u010din. Zato lahko nadaljnje preiskovanje anomalij privede do zanimivih rezultatov.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Napomena<\/i>: v spletnem vmesniku SMC so podatki v zavihkih <i>Nadzorne plo\u0161\u010de <\/i>prikazani samo za pretekli teden in v zavihku <i>Monitor<\/i> za preteklih 2 tedna. Za analizo dogodkov, ki so starej\u0161i, in za generiranje poro\u010dil je treba delati z java konzolo na ra\u010dunalniku administratorja.<\/p>\n<h2>5. Iskanje notranjih skeniranj omre\u017eja<\/h2>\n<p>\nZdaj si oglejmo nekaj primerov virov \u2014 incidentov varnosti. Ta funkcionalnost je bolj zanimiva za varnostne strokovnjake.<\/p>\n<p>V StealthWatch je ve\u010d prednastavljenih vrst dogodkov skeniranja:<\/p>\n<ul>\n<li>Port Scan \u2014 vir skenira \u0161tevilne porte ciljnega vozli\u0161\u010da.<\/li>\n<li>Addr tcp scan \u2014 vir skenira celotno omre\u017eje po enem in istem TCP portu, pri tem pa spreminja naslov IP cilja. Pri tem vir prejme TCP Reset pakete ali ne prejme odgovorov sploh.<\/li>\n<li>Addr udp scan \u2014 vir skenira celotno omre\u017eje po enem in istem UDP portu, pri tem pa spreminja naslov IP cilja. Pri tem vir prejme ICMP Port Unreachable pakete ali ne prejme odgovorov sploh.<\/li>\n<li>Ping Scan \u2014 vir po\u0161ilja ICMP zahteve na celotno omre\u017eje z namenom iskanja odgovorov.<\/li>\n<li>Stealth Scan tcp\/udp \u2014 vir je uporabil enaka vrata za povezovanje z ve\u010d vrati na ciljnih vozli\u0161\u010dih hkrati.<\/li>\n<\/ul>\n<p>\nZa la\u017eje iskanje vseh notranjih skenerjev obstaja omre\u017ena aplikacija za <i>StealthWatch \u2014 Ocena vidljivosti<\/i>. Ko preidete v zavihek <i>Nadzorne plo\u0161\u010de \u2192 Ocena vidljivosti \u2192 Notranji omre\u017eni skenerji<\/i> boste videli varnostne incidente, povezane s skeniranjem, v zadnjih 2 tednih.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKliknite gumb <i>Podrobnosti<\/i>, bo bo vidno za\u010detek skeniranja vsakega omre\u017eja, trend pretoka in ustrezne alarme.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNato se lahko 'potopite' v gostitelja prek zavihka na prej\u0161njem posnetku in vidite varnostne dogodke ter aktivnosti v zadnjem tednu za tega gostitelja.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKot primer analiziramo dogodek <i>Skener vrat<\/i> iz gostitelja <i>10.201.3.149<\/i> na <i>10.201.0.72<\/i>, s klikom na <i>Dejanja &gt; Povezani pretoki<\/i>. Za\u010dne se iskanje po tokovih in izpi\u0161e se ustrezne informacije.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKot vidimo, je ta gostitelj iz enega svojih vrat <i>51508\/TCP<\/i> skaniral 3 ure nazaj ciljni gostitelj po vratih<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. Nekatera polja ne prikazujejo informacij ali zato, ker ne vsa polja Netflow podpirajo Netflow izvoznika.<\/p>\n<h2>6. Analiza prenesenih zlonamernih datotek s pomo\u010djo CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 obla\u010dna analiza Cisco, ki se odli\u010dno integrira s Cisco StealthWatch in omogo\u010da dopolnitev brez podpisne analize s podpisano. S tem postane mogo\u010de odkrivanje trojancev, omre\u017enih \u010drvov, zlonamerne programske opreme ni\u010delnega dne in drugih zlonamernih dostopov ter njihovo \u0161irjenje znotraj omre\u017eja. Prav tako prej omenjena tehnologija ETA omogo\u010da analizo takih zlonamernih komunikacij tudi v \u0161ifriranem prometu.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa prvem zavihku v spletno vmesniku je poseben pripomo\u010dek <i>Cognitive Threat Analytics<\/i>. Kratka povzetek govori o odkritih gro\u017enjah na uporabni\u0161kih gostiteljih: trojanec, prevarantska programska oprema, nadle\u017ena oglasna programska oprema. Beseda '\u0160ifrirano' prav tako dokazuje delovanje ETA. Ko kliknete na gostitelja, se izpi\u0161ejo vse informacije, varnostni dogodki tudi dnevniki po CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKo se pomikate po vsakem koraku CTA, se prika\u017eejo podrobne informacije o interakcijah. Za popolno analizo je najbolje klikniti <i>Poglej podrobnosti incidenta<\/i>, in prispete v lo\u010deno konzolo. <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV zgornjem desnem kotu filtr omogo\u010da prikazovanje dogodkov po ravni pomembnosti. Ko se pomikate po dolo\u010deni anomaliji, se na dnu zaslona prika\u017eejo dnevniki s pripadajo\u010dim \u010dasovnim razporedom na desni. S tem strokovnjak za informacijsko varnost natan\u010dno razume, kateri oku\u017eeni gostitelj je po katerih dejanjih za\u010del izvajati kak\u0161na dejanja.<\/p>\n<p>Spodaj je prikazan \u0161e en primer \u2014 ban\u010dni trojanec, s katerim je bil oku\u017een gostitelj <i>198.19.30.36<\/i>. Ta gostitelj je za\u010del sodelovati z zlonamernimi domenami, dnevniki pa prikazujejo informacije o pretokih teh interakcij. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza in preiskava incidentov. Del 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJedno od najboljih rje\u0161enja koje mo\u017ee biti je staviti host u karantenu zahvaljuju\u0107i nativnom <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integracije <\/a><\/noindex>Cisco ISE za daljnje lije\u010denje i analizu. <\/p>\n<h2>Zaklju\u010dek<\/h2>\n<p>\nRje\u0161enje Cisco StealthWatch jedno je od lidera me\u0111u proizvodima za nadzor mre\u017ee kako s aspekta analize mre\u017ee, tako i informacijske sigurnosti. Zahvaljuju\u0107i njemu, mogu\u0107e je otkrivati ilegalne interakcije unutar mre\u017ee, ka\u0161njenja aplikacija, najaktivnije korisnike, anomalije, zlonamjerni softver i APT. \u0160tovi\u0161e, mogu\u0107e je prona\u0107i skeniranja, pentestere, provoditi kriptoaudite HTTPS prometa. Jo\u0161 vi\u0161e slu\u010dajeva upotrebe mo\u017eete prona\u0107i na <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">linku<\/a><\/noindex>.<\/p>\n<p>Ako imate \u017eelju provjeriti koliko va\u0161a mre\u017ea glatko i efikasno funkcioni\u0161e, po\u0161aljite <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">prijavo<\/a><\/noindex>. <br \/>\nU bliskoj budu\u0107nosti planiramo jo\u0161 nekoliko tehni\u010dkih objava o razli\u010ditim IB proizvodima. Ako vas zanima ova tema, pratite a\u017euriranja na na\u0161im kanalima (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: analiza i istra\u017eivanje incidenta. Dio 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}