{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb zgjidhje analitike n\u00eb fush\u00ebn e siguris\u00eb, e cila ofron monitorim gjith\u00ebp\u00ebrfshir\u00ebs t\u00eb k\u00ebrc\u00ebnimeve n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndare. N\u00eb themel t\u00eb funksionimit t\u00eb StealthWatch \u00ebsht\u00eb grumbullimi i NetFlow dhe IPFIX nga routerat, switch-et dhe pajisje t\u00eb tjera rrjeti. Si rezultat, rrjeti b\u00ebhet nj\u00eb sensor i ndjesh\u00ebm dhe lejon administratorin t\u00eb shikoj\u00eb n\u00eb vende ku metodat tradicionale t\u00eb mbrojtjes s\u00eb rrjetit, si Firewall-i i Generat\u00ebs s\u00eb Re, nuk arrijn\u00eb.<\/p>\n<p>N\u00eb artikujt e m\u00ebparsh\u00ebm kam shkruar tashm\u00eb p\u00ebr StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">prezantimi i par\u00eb dhe mund\u00ebsit\u00eb<\/a><\/noindex>, si dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">implementimi dhe konfigurimi<\/a><\/noindex>. Tani propozoj t\u00eb ecim p\u00ebrpara dhe t\u00eb diskutojm\u00eb se si duhet t\u00eb punojm\u00eb me alarmet dhe t\u00eb hetojm\u00eb incidentet e siguris\u00eb q\u00eb gjeneron zgjidhja. Do t\u00eb jap 6 shembuj, t\u00eb cil\u00ebt, shpresoj, do t\u00eb ofrojn\u00eb nj\u00eb paraqitje t\u00eb mir\u00eb mbi dobishm\u00ebrin\u00eb e produktit.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nS\u00eb pari, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb StealthWatch ka nj\u00eb shp\u00ebrndarje t\u00eb caktuar t\u00eb njoftimeve n\u00eb algoritme dhe feed-e. T\u00eb parat jan\u00eb nj\u00eb lloj alarmi (njoftime), ndonj\u00ebher\u00eb t\u00eb cilat ndihmojn\u00eb n\u00eb zbulimin e gj\u00ebrave t\u00eb dyshimta n\u00eb rrjet. T\u00eb dytat jan\u00eb incidentet e siguris\u00eb. N\u00eb k\u00ebt\u00eb artikull do t\u00eb shqyrtohen 4 shembuj t\u00eb njoftimeve nga algoritmet dhe 2 shembuj t\u00eb feed-eve.<\/p>\n<h2>1. Analiza e nd\u00ebrveprimeve m\u00eb t\u00eb m\u00ebdha brenda rrjetit<\/h2>\n<p>\nHapi fillestar p\u00ebr konfigurimin e StealthWatch \u00ebsht\u00eb p\u00ebrcaktimi i hosteve dhe rrjeteve sipas grupeve. N\u00eb nd\u00ebrfaqen web, skeda <i>Configure &gt; Host Group Management<\/i> duhet t\u00eb ndaj\u00eb rrjetet, hostet, server\u00ebt n\u00eb grupe p\u00ebrkat\u00ebse. Grupe mund t\u00eb krijohen edhe vet\u00eb. P\u00ebrve\u00e7 k\u00ebsaj, analiza e nd\u00ebrveprimeve midis hosteve n\u00eb Cisco StealthWatch \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme, sepse jo vet\u00ebm q\u00eb mund t\u00eb ruani filtrat e k\u00ebrkimit sipas flukseve, por edhe vet\u00eb rezultatet.<\/p>\n<p>P\u00ebr fillim, n\u00eb nd\u00ebrfaqen web, duhet t\u00eb hyni n\u00eb sked\u00ebn <i>Analyze &gt; Flow Search<\/i>. M\u00eb pas, duhet t\u00eb vendosni parametrat e m\u00ebposht\u00ebm:<\/p>\n<ul>\n<li>Search Type \u2014 Top Conversations (nd\u00ebrveprime m\u00eb t\u00eb njohura)<\/li>\n<li>Time Range \u2014 24 hours (periudh\u00eb kohe, mund t\u00eb p\u00ebrdorni ndonj\u00eb tjet\u00ebr)<\/li>\n<li>Search Name \u2014 Top Conversations Inside-Inside (\u00e7do em\u00ebr t\u00eb kuptuesh\u00ebm)<\/li>\n<li>Subjekti \u2014 Grupi i Hosteve \u2192 Brend\u00ebsia e Hosteve (burimi \u2014 grupi i nyjeve t\u00eb brendshme)<\/li>\n<li>Konnection (mund t\u00eb specifikoni porte, aplikacione)<\/li>\n<li>Peer \u2014 Grupi i Hosteve \u2192 Brend\u00ebsia e Hosteve (destinimi \u2014 grupi i nyjeve t\u00eb brendshme)<\/li>\n<li>N\u00eb Opsionet Avancuara gjithashtu mund t\u00eb specifikoni kolektorin nga i cili shikohet t\u00eb dh\u00ebnat, renditjen e daljes (sip\u00ebrfaqja, rrjedhat dhe t\u00eb tjera). Do ta l\u00eb si\u00e7 \u00ebsht\u00eb.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas klikimit n\u00eb butonin <i>K\u00ebrko <\/i>shkruhet lista e nd\u00ebrveprimeve, t\u00eb cilat jan\u00eb tashm\u00eb renditur sipas sasis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb transferuara.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb shembullin tim, hosti <i>10.150.1.201<\/i> (server) brenda vet\u00ebm nj\u00eb rrjedhe ka transferuar<i> 1.5 GB<\/i> trafikun n\u00eb hostin <i>10.150.1.200<\/i> (klient) sipas protokollit <i>mysql<\/i>. Butoni <i>Menaxho Shtyllat<\/i> lejon t\u00eb shtoni m\u00eb shum\u00eb shtylla n\u00eb t\u00eb dh\u00ebnat e daljes.<\/p>\n<p>Pastaj, sipas d\u00ebshir\u00ebs s\u00eb administratorit, mund t\u00eb krijohet nj\u00eb rregull t\u00eb personalizuar, i cili do t\u00eb aktivizohet vazhdimisht p\u00ebr k\u00ebt\u00eb lloj nd\u00ebrveprimi dhe do t\u00eb njoftoj\u00eb p\u00ebrmes SNMP, email ose Syslog. <\/p>\n<h2>2. Analiza e nd\u00ebrveprimeve m\u00eb t\u00eb ngadalta klient-server brenda rrjetit p\u00ebr vonesa<\/h2>\n<p>\nEtiketat <b>SRT (Koha e P\u00ebrgjigjes s\u00eb Serverit)<\/b>, <b>RTT (Koha e Rrug\u00ebs s\u00eb kthimit)<\/b> lejojn\u00eb t\u00eb kuptohen vonesat e server\u00ebve dhe vonesat e p\u00ebrgjithshme n\u00eb rrjet. Ky mjet \u00ebsht\u00eb ve\u00e7an\u00ebrisht i dobish\u00ebm kur duhet t\u00eb gjendet shpejt arsyeja e ankesave t\u00eb p\u00ebrdoruesve p\u00ebr nj\u00eb aplikacion q\u00eb punon ngadal\u00eb.<\/p>\n<p><i>Sh\u00ebnim<\/i>: pothuajse t\u00eb gjith\u00eb eksportuesit e Netflow <b>nuk di<\/b> d\u00ebrgoj etiketat SRT, RTT, p\u00ebr k\u00ebt\u00eb arsye shpesh p\u00ebr t\u00eb par\u00eb k\u00ebto t\u00eb dh\u00ebna n\u00eb FlowSensor duhet t\u00eb konfigurojm\u00eb d\u00ebrgimin e nj\u00eb kopjeje t\u00eb trafikut nga pajisjet rrjetit. FlowSensor nga ana e tij ofron IPFIX t\u00eb zgjeruar p\u00ebr FlowCollector.<\/p>\n<p>Kjo analiz\u00eb \u00ebsht\u00eb m\u00eb e leht\u00eb p\u00ebr t'u kryer n\u00eb aplikacionin java StealthWatch, i cili instalohet n\u00eb kompjuterin e administratorit.<\/p>\n<p>Klikoni me t\u00eb djatht\u00ebn n\u00eb <i>Inside Hosts<\/i> dhe kaloni n\u00eb sked\u00ebn <i>Flow Table<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShtypni n\u00eb <i>Filter <\/i>dhe vendosni parametrat e nevojsh\u00ebm. Si shembull:<\/p>\n<ul>\n<li>Date\/Time \u2014 P\u00ebr 3 dit\u00ebt e fundit<\/li>\n<li>Performance \u2014 Mesatarja e Koh\u00ebs s\u00eb Kthimit t\u00eb Rrethit &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas nxjerrjes s\u00eb t\u00eb dh\u00ebnave, duhet t\u00eb shtoni fushat RTT, SRT q\u00eb na interesojn\u00eb. P\u00ebr k\u00ebt\u00eb, klikoni n\u00eb kolon\u00ebn n\u00eb foto dhe me t\u00eb djatht\u00ebn zgjidhni <i>Menaxho Shtyllat<\/i>. M\u00eb pas klikoni n\u00eb parametrat RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas p\u00ebrpunimit t\u00eb k\u00ebrkes\u00ebs, un\u00eb rendita sipas RTT mesatar dhe pash\u00eb bashk\u00ebveprimet m\u00eb t\u00eb ngadalta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb hyr\u00eb n\u00eb informacion t\u00eb detajuar, klikoni me t\u00eb djatht\u00ebn mbi rrjedh\u00ebn dhe zgjidhni <i>Quick View for Flow<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo informacion tregon se hosti <i>10.201.3.59<\/i> nga grupa <i>Sales and Marketing<\/i> p\u00ebr protokollin <i>NFS<\/i> i drejtohet <i>DNS serverit<\/i> p\u00ebr nj\u00eb minut\u00eb dhe 23 sekonda dhe ka nj\u00eb vones\u00eb t\u00eb tmerrshme. N\u00eb sked\u00ebn <i>Interfaces <\/i>mund t\u00eb dini se nga cili eksportues Netflow jan\u00eb marr\u00eb informacionet. N\u00eb seksionin <i>Tabel\u00eb <\/i> paraqitet informacion m\u00eb i detajuar rreth nd\u00ebrveprimit.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas, duhet t\u00eb dini se cilat pajisje po d\u00ebrgojn\u00eb trafik n\u00eb FlowSensor dhe problemi ndoshta q\u00ebndron aty.<\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, StealthWatch \u00ebsht\u00eb unik n\u00eb at\u00eb q\u00eb kryen <b>deduplication<\/b> e t\u00eb dh\u00ebnave (bashkon rrjedhat e nj\u00ebjta). Si rezultat, mund t\u00eb mblidhni praktikisht nga t\u00eb gjitha pajisjet Netflow dhe t\u00eb mos shqet\u00ebsoheni p\u00ebr shum\u00eb t\u00eb dh\u00ebna t\u00eb p\u00ebrs\u00ebritura. N\u00eb t\u00eb v\u00ebrtet\u00eb, n\u00eb k\u00ebt\u00eb skem\u00eb do t\u00eb ndihmoj\u00eb t\u00eb kuptoni se n\u00eb cilin hop ka vonesat m\u00eb t\u00eb m\u00ebdha.<\/p>\n<h2>3. Auditimi i protokolleve kriptografike HTTPS<\/h2>\n<p>\n<b>ETA (Analiza e Trafikut t\u00eb Kriptuar)<\/b> \u00ebsht\u00eb nj\u00eb teknologji e zhvilluar nga Cisco q\u00eb lejon identifikimin e lidhjeve keqdash\u00ebse n\u00eb trafik t\u00eb kriptuar pa e dekoduar at\u00eb. P\u00ebr m\u00eb tep\u00ebr, kjo teknologji lejon \"zhb\u00ebrjen\" e HTTPS n\u00eb versionet TLS dhe protokollet kriptografike q\u00eb p\u00ebrdoren gjat\u00eb lidhjeve. Ky funksionalitet \u00ebsht\u00eb ve\u00e7an\u00ebrisht i dobish\u00ebm kur nevojitet t\u00eb identifikohen nyjet rrjetie q\u00eb p\u00ebrdorin standarde t\u00eb dob\u00ebta kripto.<\/p>\n<p><i>Sh\u00ebnim<\/i>: m\u00eb par\u00eb duhet t\u00eb instaloni aplikacionin e rrjetit n\u00eb StealthWatch \u2014 <b>Auditimi Kriptografik ETA<\/b>.<\/p>\n<p>Shkoni te pesta <i>Dashboards \u2192 Audit Kriptografik ETA<\/i> dhe zgjidhni grupin e hosteve q\u00eb do t\u00eb analizoni. P\u00ebr nj\u00eb pamje t\u00eb p\u00ebrgjithshme, zgjedhim <i>Inside Hosts<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb v\u00ebreni se \u00ebsht\u00eb e qart\u00eb versione TLS dhe standardi i p\u00ebrkat\u00ebsish\u00ebm kriptografik. Sipas skem\u00ebs s\u00eb zakonshme n\u00eb kolon\u00ebn <i>Veprimet <\/i>shkoni te <i>Shiko Flukset<\/i> dhe nisin k\u00ebrkimin n\u00eb nj\u00eb pesta t\u00eb re.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNga rezultati del se hosti <i>198.19.20.136<\/i> p\u00ebr nj\u00eb periudh\u00eb t\u00eb <i>12 or\u00ebsh<\/i> ka p\u00ebrdorur HTTPS me TLS 1.2, ku algoritmi i enkriptimit <i>AES-256<\/i> dhe funksioni i hashit <i>SHA-384<\/i>. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, ETA lejon t\u00eb zbuloj\u00eb algoritmat e dob\u00ebta n\u00eb rrjet.<\/p>\n<h2>4. Analiza e anomalive n\u00eb rrjet<\/h2>\n<p>\nCisco StealthWatch \u00ebsht\u00eb n\u00eb gjendje t\u00eb njoh\u00eb anomali t\u00eb trafikut n\u00eb rrjet, duke p\u00ebrdorur tre instrumente: <b>Ngjarjet Kryesore<\/b> (ngjarjet e sigurta), <b>Ngjarjet e Marr\u00ebdh\u00ebnieve<\/b> (ngjarjet e interaksioneve midis segmenteve, nyjeve t\u00eb rrjetit) dhe <b>analiza e sjelljes<\/b>.<\/p>\n<p>Analiza e sjelljes, nga ana tjet\u00ebr, lejon nd\u00ebrtimin e nj\u00eb modeli sjelljeje p\u00ebr nj\u00eb prit\u00ebs t\u00eb caktuar ose nj\u00eb grup prit\u00ebsish me kalimin e koh\u00ebs. Sa m\u00eb shum\u00eb trafik t\u00eb kaloj\u00eb p\u00ebrmes StealthWatch, aq m\u00eb t\u00eb sakta do t\u00eb jen\u00eb alarmet fal\u00eb k\u00ebsaj analize. N\u00eb fillim, sistemi ngat\u00ebrron shpesh, prandaj rregullat duhet t\u00eb \u201cregullohen\u201d manualisht. Rekomandoj q\u00eb gjat\u00eb jav\u00ebve t\u00eb para t\u00eb mos jepni r\u00ebnd\u00ebsi ngjarjeve t\u00eb tilla, pasi sistemi do t\u00eb rregulloj\u00eb vet\u00eb, ose mund t\u00eb shtoni p\u00ebrjashtime.<\/p>\n<p>M\u00eb posht\u00eb \u00ebsht\u00eb nj\u00eb shembull i nj\u00eb rregulli t\u00eb paracaktuar <i>Anomaly<\/i>, i cili thot\u00eb se ngjarja do t\u00eb aktivizohet pa alarm n\u00ebse <i>nj\u00eb prit\u00ebs n\u00eb grupin Inside Hosts interakton me grupin Inside Hosts dhe brenda 24 or\u00ebve, trafiku kalon 10 megabajt<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr shembull, le t\u00eb marrim alarmin <i>Data Hoarding<\/i>, q\u00eb do t\u00eb thot\u00eb se nj\u00eb prit\u00ebs burimi\/destinacioni ka ngarkuar\/shkarkuar nj\u00eb sasi t\u00eb jasht\u00ebzakonshme t\u00eb t\u00eb dh\u00ebnave nga grupi i prit\u00ebsve ose nga nj\u00eb prit\u00ebs. Kliko n\u00eb ngjarje dhe kalojm\u00eb n\u00eb tabel\u00ebn q\u00eb tregon prit\u00ebsit q\u00eb e aktivizuan at\u00eb. M\u00eb pas, zgjedhim prit\u00ebsin q\u00eb na intereson n\u00eb kolon\u00eb <i>Data Hoarding<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNj\u00eb ngjarje tregohet, e cila thot\u00eb se jan\u00eb zbuluar 162k \"pik\u00eb\" dhe sipas politik\u00ebs lejohen 100k \"pik\u00eb\" \u2014 k\u00ebto jan\u00eb metrikat e brendshme t\u00eb StealthWatch. N\u00eb kolon\u00ebn <i>Veprimet <\/i>klikojm\u00eb <i>Shiko Flukset<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNe mund t\u00eb v\u00ebzhgojm\u00eb se <i>ky host<\/i> ka interaguar nat\u00ebn me hostin <i>10.201.3.47<\/i> nga departamenti <i>Shitje &amp; Marketing<\/i> p\u00ebr protokollin <i>HTTPS <\/i>dhe shkarkoi <i>1.4 GB<\/i>. Mund t\u00eb jet\u00eb se ky shembull nuk \u00ebsht\u00eb shum\u00eb i p\u00ebrshtatsh\u00ebm, por identifikimi i interaksioneve deri n\u00eb disa qindra gigabajt b\u00ebhet n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb. Prandaj, hetimi i m\u00ebtejsh\u00ebm i anomalive mund t\u00eb \u00e7oj\u00eb n\u00eb rezultate interesante.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Sh\u00ebnim<\/i>: n\u00eb nd\u00ebrfaqen web SMC t\u00eb dh\u00ebnat n\u00eb skedat <i>Dashboard <\/i>shfaqen vet\u00ebm p\u00ebr jav\u00ebn e fundit dhe n\u00eb sked\u00ebn <i>Monitor<\/i> p\u00ebr dy jav\u00ebt e fundit. N\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb analizohet ngjarjet m\u00eb t\u00eb vjetra dhe p\u00ebr gjenerimin e raporteve, duhet t\u00eb punoni me konsol\u00ebn java n\u00eb kompjuterin e administratorit.<\/p>\n<h2>5. Gjetja e skanimeve t\u00eb brendshme t\u00eb rrjetit<\/h2>\n<p>\nTani le t\u00eb shqyrtojm\u00eb disa shembuj t\u00eb fisheve \u2014 incidenteve t\u00eb siguris\u00eb. Ky funksionalitet \u00ebsht\u00eb m\u00eb i interesuar p\u00ebr sigurisht.<\/p>\n<p>Ka disa lloje t\u00eb paracaktuar t\u00eb ngjarjeve t\u00eb skanimit n\u00eb StealthWatch:<\/p>\n<ul>\n<li>Port Scan \u2014 burimi skanon shum\u00eb porte t\u00eb nj\u00eb hosti t\u00eb destinuar.<\/li>\n<li>Addr tcp scan \u2014 burimi skanon t\u00ebr\u00eb rrjetin p\u00ebr nj\u00eb port TCP t\u00eb nj\u00ebjt\u00eb, duke ndryshuar adres\u00ebn IP t\u00eb destinacionit. N\u00eb k\u00ebt\u00eb rast, burimi merr paketa TCP Reset ose nuk merr kurr\u00eb p\u00ebrgjigje.<\/li>\n<li>Addr udp scan \u2014 burimi skanon t\u00ebr\u00eb rrjetin p\u00ebr nj\u00eb port UDP t\u00eb nj\u00ebjt\u00eb, duke ndryshuar adres\u00ebn IP t\u00eb destinacionit. N\u00eb k\u00ebt\u00eb rast, burimi merr paketa ICMP Port Unreachable ose nuk merr kurr\u00eb p\u00ebrgjigje.<\/li>\n<li>Ping Scan \u2014 burimi d\u00ebrgon k\u00ebrkesa ICMP n\u00eb t\u00ebr\u00eb rrjetin p\u00ebr t\u00eb k\u00ebrkuar p\u00ebrgjigje.<\/li>\n<li>Stealth Scan t\u0441p\/udp \u2014 burimi p\u00ebrdor nj\u00eb port t\u00eb tij p\u00ebr t'u lidhur me shum\u00eb porte n\u00eb nodin e destinacionit n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb.<\/li>\n<\/ul>\n<p>\nP\u00ebr nj\u00eb gjetje m\u00eb t\u00eb leht\u00eb t\u00eb t\u00eb gjitha skanuesve t\u00eb brendsh\u00ebm, ekziston aplikacioni network p\u00ebr <i>StealthWatch \u2014 Vler\u00ebsimi i Shikueshm\u00ebris\u00eb<\/i>. Duke kaluar n\u00eb sked\u00ebn <i>Dashboards \u2192 Vler\u00ebsimi i Shikueshm\u00ebris\u00eb \u2192 Skanuesit e Rrjetit t\u00eb Brendsh\u00ebm<\/i> do t\u00eb shihni incidente t\u00eb siguris\u00eb q\u00eb lidhen me skanimin, gjat\u00eb 2 jav\u00ebve t\u00eb fundit.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke klikuar n\u00eb butonin <i>Details<\/i>, do t\u00eb shihni fillimet e skanimit p\u00ebr \u00e7do rrjet, tendenc\u00ebn e trafikut dhe alarmet p\u00ebrkat\u00ebse.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas mund t\u00eb \"shkoni\" n\u00eb host nga skeda n\u00eb skrinin e m\u00ebparsh\u00ebm dhe t\u00eb shihni ngjarjet e siguris\u00eb, si dhe aktivitetin e jav\u00ebs s\u00eb fundit p\u00ebr k\u00ebt\u00eb host.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi shembull, le t\u00eb analizojm\u00eb nj\u00eb ngjarje <i>Port Scan<\/i> nga hosti <i>10.201.3.149<\/i> n\u00eb <i>10.201.0.72<\/i>, duke klikuar n\u00eb <i>Actions &gt; Associated Flows<\/i>. Fillon k\u00ebrkimi p\u00ebr rrjedhat dhe shfaqet informacioni p\u00ebrkat\u00ebs.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi\u00e7 e shohim, ky host nga nj\u00eb port i tij <i>51508\/TCP<\/i> ka skanuar 3 or\u00eb m\u00eb par\u00eb hostin e destinacionit n\u00eb portet<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. Disa fusha nuk tregojn\u00eb informacion ose p\u00ebr shkak se jo t\u00eb gjitha fushat Netflow mb\u00ebshteten n\u00eb eksportuesin Netflow.<\/p>\n<h2>6. Analiza e malware-ve t\u00eb shkarkuara me CTA<\/h2>\n<p>\n<b>CTA (Cognitive Threat Analytics)<\/b> \u2014 analiza cloud e Cisco, e cila integrohet shk\u00eblqyesh\u00ebm me Cisco StealthWatch dhe lejon plot\u00ebsimin e analiz\u00ebs pa shenja me analiz\u00ebn me shenja. K\u00ebshtu b\u00ebhet e mundur identifikimi i trojan\u00ebve, worms rrjet\u00ebsor\u00eb, malware-ve t\u00eb dit\u00ebs zero dhe malware-ve t\u00eb tjer\u00eb dhe p\u00ebrhapja e tyre brenda rrjetit. Po ashtu, teknologjia e p\u00ebrmendur m\u00eb par\u00eb ETA lejon analiz\u00ebn e k\u00ebtyre komunikimeve t\u00eb d\u00ebmshme edhe n\u00eb trafikun e enkriptuar.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPik\u00ebrisht n\u00eb sked\u00ebn e par\u00eb n\u00eb nd\u00ebrfaqen e internetit ka nj\u00eb widget t\u00eb ve\u00e7ant\u00eb <i>Cognitive Threat Analytics<\/i>. Nj\u00eb p\u00ebrmbledhje e shkurt\u00ebr flet p\u00ebr k\u00ebrc\u00ebnimet e zbuluara n\u00eb hostet e p\u00ebrdoruesve: trojan, software t\u00eb mashtrimit, software reklamuese t\u00eb bezdisshme. Fjal\u00eb \u201cEncrypted\u201d tregon pik\u00ebrisht p\u00ebr funksionimin e E.T.A. Duke klikuar n\u00eb host, shfaqet t\u00eb gjith\u00eb informacioni, ngjarjet e siguris\u00eb p\u00ebrfshir\u00eb log\u00ebt e C.T.A.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke kaluar mbi \u00e7do hap t\u00eb C.T.A., ngjarjet shfaqin informacion t\u00eb detajuar mbi nd\u00ebrveprimin. P\u00ebr nj\u00eb analiz\u00eb t\u00eb plot\u00eb, duhet t\u00eb klikoni <i>Shiko Detajet e Ndodhis\u00eb<\/i>, dhe do t\u00eb hyni n\u00eb nj\u00eb konsol\u00eb t\u00eb ve\u00e7ant\u00eb <i>Cognitive Threat Analytics<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebndin e sip\u00ebrm t\u00eb djatht\u00eb, filtroi lejon t\u00eb shfaqen ngjarjet sipas nivelit t\u00eb kritik\u00ebs. Duke kaluar mbi nj\u00eb anomali t\u00eb ve\u00e7ant\u00eb, n\u00eb fund t\u00eb ekranit shfaqen log\u00ebt me p\u00ebrkat\u00ebsin e koh\u00ebs n\u00eb t\u00eb djatht\u00eb. K\u00ebshtu, specialisti i departamentit t\u00eb siguris\u00eb \u00ebsht\u00eb n\u00eb gjendje t\u00eb kuptoj\u00eb qart\u00eb se cili host \u00ebsht\u00eb infektuar dhe \u00e7far\u00eb veprimesh ka nd\u00ebrmarr\u00eb pas veprimeve t\u00eb caktuara.<\/p>\n<p>M\u00eb posht\u00eb tregohet nj\u00eb tjet\u00ebr shembull \u2013 nj\u00eb trojan bankar q\u00eb ka infektuar hostin <i>198.19.30.36<\/i>. Ky host ka filluar nd\u00ebrveprimin me domenet e d\u00ebmshme, dhe n\u00eb log\u00ebt shfaqet informacioni mbi rrjedhat e k\u00ebtyre nd\u00ebrveprimeve. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb tej, nj\u00eb nga zgjidhjet m\u00eb t\u00eb mira q\u00eb mund t\u00eb jet\u00eb, \u00ebsht\u00eb t\u00eb p\u00ebrjashtohet hosti n\u00eb karantin\u00eb p\u00ebrmes nj\u00eb nativ. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integrimi <\/a><\/noindex>me Cisco ISE p\u00ebr trajtim dhe analiz\u00eb t\u00eb m\u00ebtejshme. <\/p>\n<h2>P\u00ebrfundimi<\/h2>\n<p>\nZgjidhja Cisco StealthWatch \u00ebsht\u00eb nj\u00eb nga lider\u00ebt n\u00eb fush\u00ebn e monitorimit t\u00eb rrjetit, si p\u00ebr nga analizimi i rrjetit ashtu edhe p\u00ebr sigurin\u00eb informative. Me t\u00eb, mund t\u00eb zbulojm\u00eb interaksione t\u00eb paligjshme brenda rrjetit, vonesa aplikacionesh, p\u00ebrdoruesit m\u00eb aktiv\u00eb, anomali, malware dhe APT. P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb e mundur t\u00eb gjeni skanime, p\u00ebntester, t\u00eb kryeni nj\u00eb audit t\u00eb kriptografis\u00eb s\u00eb trafikut HTTPS. M\u00eb shum\u00eb raste p\u00ebrdorimi mund t\u00eb gjeni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">lidhjes<\/a><\/noindex>.<\/p>\n<p>N\u00ebse keni d\u00ebshir\u00eb t\u00eb kontrolloni sesa mir\u00eb dhe efikas funksionon rrjeti juaj, d\u00ebrgoni <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">nj\u00eb k\u00ebrkes\u00eb<\/a><\/noindex>. <br \/>\nN\u00eb t\u00eb ardhmen e af\u00ebrt planifikojm\u00eb disa publikime teknike mbi produkte t\u00eb ndryshme t\u00eb siguris\u00eb informative. N\u00ebse jeni t\u00eb interesuar p\u00ebr k\u00ebt\u00eb tem\u00eb, ndiqni p\u00ebrdit\u00ebsimet n\u00eb kanalet tona (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogu i Zgjidhjeve TS<\/a><\/noindex>)!<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3 | ProHoster","description":"Cisco StealthWatch \u2014 \u00ebsht\u00eb nj\u00eb zgjidhje analitike n\u00eb fush\u00ebn e siguris\u00eb q\u00eb ofron monitorim t\u00eb gjithansh\u00ebm t\u00eb k\u00ebrc\u00ebnimeve n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb. Thelbi i funksionimit t\u00eb StealthWatch bazon n\u00eb mbledhjen e NetFlow dhe IPFIX nga router-at, switch-at dhe pajisje t\u00eb tjera rrjetesh. Si rezultat, rrjeti b\u00ebhet nj\u00eb sensor i ndjesh\u00ebm dhe i lejon administrator\u00ebve t\u00eb shikojn\u00eb n\u00eb vende ku metodat tradicionale t\u00eb mbrojtjes s\u00eb rrjetit, si Next Generation, nuk arrijn\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:description":"Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}