{"id":90228,"date":"2020-07-30T01:42:34","date_gmt":"2020-07-29T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3"},"modified":"2020-07-30T01:42:34","modified_gmt":"2020-07-29T23:42:34","slug":"stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","title":{"rendered":"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3efab47dd80ed8bd6a81dbca5bedcc72.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">Cisco StealthWatch<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb zgjidhje analitike n\u00eb fush\u00ebn e sigurimit q\u00eb ofron monitorim gjith\u00ebp\u00ebrfshir\u00ebs t\u00eb k\u00ebrc\u00ebnimeve n\u00eb nj\u00eb rrjet t\u00eb shp\u00ebrndar\u00eb. Baza e funksionimit t\u00eb StealthWatch \u00ebsht\u00eb mbledhja e NetFlow dhe IPFIX nga router-at, switch-at dhe pajisje t\u00eb tjera rrjetesh. Si rezultat, rrjeti b\u00ebhet nj\u00eb sensor i ndjesh\u00ebm dhe lejon administratorin t\u00eb shikoj\u00eb aty ku metodat tradicionale t\u00eb mbrojtjes s\u00eb rrjetit, si Firewall-i i Brezit t\u00eb Ardhsh\u00ebm, nuk arrijn\u00eb dot.<\/p>\n<p>N\u00eb artikujt e m\u00ebparsh\u00ebm, un\u00eb kam shkruar tashm\u00eb p\u00ebr StealthWatch: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/458626\/\">para paraqitjes dhe mund\u00ebsive<\/a><\/noindex>, si dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/461831\/\">dispozitimi dhe konfigurimi<\/a><\/noindex>. Tani propozoj t\u00eb vazhdojm\u00eb dhe t\u00eb diskutojm\u00eb se si duhet t\u00eb punojm\u00eb me alarmet dhe t\u00eb hetojm\u00eb incidentet e siguris\u00eb q\u00eb gjeneron zgjidhja. Do t\u00eb jap 6 shembuj, t\u00eb cil\u00ebt shpresoj se do t\u00eb ofrojn\u00eb nj\u00eb ide t\u00eb mir\u00eb p\u00ebr dobishm\u00ebrin\u00eb e produktit.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nS\u00eb pari, duhet th\u00ebn\u00eb se n\u00eb StealthWatch ka nj\u00eb ndarje t\u00eb caktuar t\u00eb alarmeve n\u00eb algoritme dhe feed-e. T\u00eb parat jan\u00eb lloje t\u00eb ndryshme alarmesh (njoftimesh), kur ndodhin, mund t\u00eb zbulojn\u00eb gj\u00ebra t\u00eb dyshimta n\u00eb rrjet. T\u00eb dytat jan\u00eb incidentet e siguris\u00eb. N\u00eb k\u00ebt\u00eb artikull do t\u00eb shqyrtohen 4 shembuj t\u00eb alarmeve t\u00eb algoritmeve dhe 2 shembuj feed-e.<\/p>\n<h2>1. Analiza e interaksioneve m\u00eb t\u00eb m\u00ebdha brenda rrjetit<\/h2>\n<p>\nHapi fillestar i konfigurimit t\u00eb StealthWatch \u00ebsht\u00eb p\u00ebrcaktimi i hosteve dhe rrjeteve sipas grupeve. N\u00eb nd\u00ebrfaqen n\u00eb internet, tabs <i>Konfiguro &gt; Menaxhimi i Grupi t\u00eb Hosteve<\/i> duhet t\u00eb shp\u00ebrndaj\u00eb rrjetet, hostet, server\u00ebt n\u00eb grupe p\u00ebrkat\u00ebse. Grupe mund t\u00eb krijohen edhe nga vet\u00eb. Me fjal\u00eb t\u00eb tjera, analiza e interaksioneve midis hosteve n\u00eb Cisco StealthWatch \u00ebsht\u00eb shum\u00eb e leht\u00eb, pasi mund t\u00eb ruani jo vet\u00ebm filtrat e k\u00ebrkimit sipas flukseve, por edhe rezultatet e tyre.<\/p>\n<p>Fillimisht, n\u00eb nd\u00ebrfaqen n\u00eb internet, duhet t\u00eb hyni n\u00eb tab-n\u00eb <i>Analiza &gt; K\u00ebrkimi i Flukseve<\/i>. M\u00eb pas duhet t\u00eb vendosni parametrat e m\u00ebposht\u00ebm:<\/p>\n<ul>\n<li>Tipi i K\u00ebrkimit \u2014 Bisedat Kryesore (interaksionet m\u00eb t\u00eb njohura)<\/li>\n<li>Intervali i Koh\u00ebs \u2014 24 or\u00eb (kjo mund t\u00eb jet\u00eb ndryshe)<\/li>\n<li>Emri i K\u00ebrkimit \u2014 Bisedat Kryesore Brenda-Brenda (\u00e7do em\u00ebr i kuptuesh\u00ebm)<\/li>\n<li>Subjekti \u2014 Grupet e Hosteve \u2192 Hostet Brenda (burimi \u2014 grupi i hosteve t\u00eb brendsh\u00ebm)<\/li>\n<li>Konnections (mund t\u00eb p\u00ebrcaktoni porte, aplikacione)<\/li>\n<li>Partner \u2014 Grupet e Hosteve \u2192 Hostet Brenda (destinimi \u2014 grupi i hosteve t\u00eb brendsh\u00ebm)<\/li>\n<li>N\u00eb Opsionet e Zgjeruara mund t\u00eb p\u00ebrcaktoni gjithashtu kolektorin, nga i cili po shikoni t\u00eb dh\u00ebnat, renditjen e daljes (sipas byte-ve, flukseve dhe t\u00eb tjera). Un\u00eb do t'i l\u00eb p\u00ebr default.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/fefc6d925ab3b155aeea2536dddaf7da.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas klikimit n\u00eb butonin <i>K\u00ebrko <\/i>shfaq lista e nd\u00ebrveprimeve, t\u00eb cilat tashm\u00eb jan\u00eb renditur sipas sasis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb d\u00ebrguara.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3fa739dec55bd4a564ee78adc2ae0e91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb shembullin tim host <i>10.150.1.201<\/i> (serveri) brenda nj\u00eb vet\u00ebm nj\u00eb rrjedhe transmetoi<i> 1.5 GB<\/i> trafik n\u00eb host <i>10.150.1.200<\/i> (klienti) sipas protokollit <i>mysql<\/i>. Butoni <i>Menaxho Kolonat<\/i> lejon t\u00eb shtoni m\u00eb shum\u00eb kolona n\u00eb t\u00eb dh\u00ebnat e treguara.<\/p>\n<p>M\u00eb tej, sipas vendimit t\u00eb administratorit, mund t\u00eb krijoni nj\u00eb rregull personal q\u00eb do t\u00eb aktivizohet vazhdimisht p\u00ebr k\u00ebt\u00eb lloj nd\u00ebrveprimi dhe do t\u00eb njoftoj\u00eb p\u00ebrmes SNMP, email ose Syslog. <\/p>\n<h2>2. Analiza e nd\u00ebrveprimeve m\u00eb t\u00eb ngadalta klient-server brenda rrjetit p\u00ebr vonesa<\/h2>\n<p>\nEtiketat <b>SRT (Koha e P\u00ebrgjigjes s\u00eb Serverit)<\/b>, <b>RTT (Koha e R\u00ebnd\u00eb p\u00ebr Udh\u00ebtime)<\/b> lejojn\u00eb t\u00eb zbulojm\u00eb vonesat e server\u00ebve dhe vonesat totale n\u00eb rrjet. Ky mjet \u00ebsht\u00eb ve\u00e7an\u00ebrisht i dobish\u00ebm kur nevojitet t\u00eb gjendet shpejt shkaku i ankesave t\u00eb p\u00ebrdoruesve p\u00ebr aplikacionin q\u00eb funksionon ngadal\u00eb.<\/p>\n<p><i>Sh\u00ebnim<\/i>: pothuajse t\u00eb gjith\u00eb eksportuesit Netflow <b>nuk din\u00eb<\/b> d\u00ebrgojn\u00eb etiketat SRT, RTT, prandaj shpeshher\u00eb, p\u00ebr t\u00eb par\u00eb k\u00ebto t\u00eb dh\u00ebna n\u00eb FlowSensor, duhet t\u00eb konfiguroni d\u00ebrgimin e nj\u00eb kopje t\u00eb trafik\u00ebve nga pajisjet rrjetore. FlowSensor, nga ana e tij, ofron IPFIX t\u00eb zgjeruar n\u00eb FlowCollector.<\/p>\n<p>K\u00ebt\u00eb analiz\u00eb \u00ebsht\u00eb m\u00eb e leht\u00eb ta b\u00ebni n\u00eb aplikacionin java StealthWatch, i cili \u00ebsht\u00eb instaluar n\u00eb kompjuterin e administratorit.<\/p>\n<p>Me klikimin e djatht\u00eb t\u00eb mausit mbi <i>Pjes\u00ebt brenda<\/i> dhe kalojm\u00eb te skeda <i>Tabela e Rrym\u00ebs<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/3a23cf8219fc2ad44eeab7da27d5e696.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlikoni n\u00eb <i>Filter <\/i>dhe vendosni parametrat e nevojsh\u00ebm. Si shembull:<\/p>\n<ul>\n<li>Data\/Koh\u00eb \u2014 P\u00ebr 3 dit\u00ebt e fundit<\/li>\n<li>Performanca \u2014 Koha Mesatare e Rrug\u00ebs s\u00eb Kthimit &gt;=50ms<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/c7c717e336dc96fce48f05bc735cd14a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a0aad8dfa8e759f22486716221ddac82.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas ekzekutimit t\u00eb t\u00eb dh\u00ebnave, duhet t\u00eb shtoni fushat RTT, SRT q\u00eb na interesojn\u00eb. P\u00ebr k\u00ebt\u00eb, duhet t\u00eb klikoni n\u00eb kolon\u00ebn n\u00eb screenshot dhe t\u00eb zgjidhni me t\u00eb djatht\u00ebn <i>Menaxho Kolonat<\/i>. M\u00eb pas klikoni mbi parametrat RTT, SRT.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/069660512595d149353ea98b9fb7c828.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas p\u00ebrpunimit t\u00eb k\u00ebrkes\u00ebs, un\u00eb e rendita sipas RTT mesatar dhe pash\u00eb nd\u00ebrveprimet m\u00eb t\u00eb ngadalta.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/669e24fabc650d607b4767c50345a12b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb hyr\u00eb n\u00eb informacionin e detajuar, duhet t\u00eb klikoni me t\u00eb djatht\u00ebn mbi rrjedh\u00ebn dhe t\u00eb zgjidhni <i>Pamja e Shpejt\u00eb p\u00ebr Rrym\u00ebn<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/6e03114b9cdbbef516d65cdc43c6b3e2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKy informacion tregon se hosti <i>10.201.3.59<\/i> nga grupi <i>Shitjet dhe Marketingu<\/i> p\u00ebrmes protokollit <i>NFS<\/i> addresses <i>p\u00ebr serverin DNS<\/i> p\u00ebr nj\u00eb minut\u00eb dhe 23 sekonda dhe ka nj\u00eb vones\u00eb t\u00eb tmerrshme. N\u00eb sked\u00ebn <i>Interface <\/i>mund t\u00eb m\u00ebsoni nga cili eksportues Netflow jan\u00eb marr\u00eb t\u00eb dh\u00ebnat. N\u00eb sked\u00ebn <i>Tabela <\/i> shfaqet informacion m\u00eb i detajuar mbi nd\u00ebrveprimin.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/66750a2e003972cabdea60096397f8be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas, duhet t\u00eb zbulojm\u00eb se cilat pajisje d\u00ebrgojn\u00eb trafik n\u00eb FlowSensor dhe problemi ka t\u00eb ngjar\u00eb t\u00eb jet\u00eb atje.<\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, StealthWatch \u00ebsht\u00eb unik sepse kryen <b>de-duplication<\/b> t\u00eb dh\u00ebnave (bashkon t\u00eb nj\u00ebjtat rrjedha). Prandaj, mund t\u00eb mblidhen praktikisht nga t\u00eb gjitha pajisjet Netflow dhe nuk ka frik\u00eb se do t\u00eb ket\u00eb shum\u00eb t\u00eb dh\u00ebna t\u00eb p\u00ebrs\u00ebritura. N\u00eb fakt, n\u00eb k\u00ebt\u00eb skem\u00eb kjo ndihmon p\u00ebr t\u00eb kuptuar se n\u00eb cilin hop ka vonesat m\u00eb t\u00eb m\u00ebdha.<\/p>\n<h2>3. Auditimi i protokolleve kriptografike HTTPS<\/h2>\n<p>\n<b>ETA (Analiza e Trafikut t\u00eb Koduar)<\/b> \u2014 teknologji e zhvilluar nga Cisco, e cila lejon identifikimin e lidhjeve t\u00eb d\u00ebmshme n\u00eb trafik t\u00eb enkriptuar pa e dekriptuar at\u00eb. P\u00ebr m\u00eb tep\u00ebr, kjo teknologji lejon \"shk\u00ebrmoqjen\" e HTTPS p\u00ebr versionet TLS dhe protokollet kriptografike q\u00eb p\u00ebrdoren gjat\u00eb lidhjeve. Ky funksionalitet \u00ebsht\u00eb ve\u00e7an\u00ebrisht i dobish\u00ebm kur duhet t\u00eb identifikohen nyjet e rrjetit q\u00eb p\u00ebrdorin standarde kriptografike t\u00eb dob\u00ebta.<\/p>\n<p><i>Sh\u00ebnim<\/i>: fillimisht duhet t\u00eb instaloni aplikacionin network n\u00eb StealthWatch \u2014 <b>Auditimi Kriptografik ETA<\/b>.<\/p>\n<p>Shk\u00ebputemi n\u00eb sked\u00ebn <i>Dashboards \u2192 Auditimi Kriptografik ETA<\/i> dhe zgjidhim grupin e hosteve q\u00eb do t\u00eb analizohet. P\u00ebr nj\u00eb pamje t\u00eb p\u00ebrgjithshme, do t\u00eb zgjidhim <i>Pjes\u00ebt brenda<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/2cac9b02089c027cc7908ce018638a68.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb v\u00ebrehet se shfaqen versioni TLS dhe standardi kriptografik p\u00ebrkat\u00ebs. Si\u00e7 \u00ebsht\u00eb zakon, n\u00eb kolon\u00ebn <i>Veprimet <\/i>kalojm\u00eb n\u00eb <i>Shiko Rjedhat<\/i> dhe k\u00ebrkimi niset n\u00eb nj\u00eb tabs t\u00eb ri.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/0b0a274b1538e58ad74a17e2a4eee160.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/ad99bdd25cd02247b6e76240fdd7edd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNga dalja duket se hosti <i>198.19.20.136<\/i> p\u00ebr nj\u00eb periudh\u00eb <i>12 or\u00eb<\/i> ka p\u00ebrdorur HTTPS me TLS 1.2, ku algoritmi i enkriptimit <i>AES-256<\/i> dhe funksioni hash <i>SHA-384<\/i>. K\u00ebshtu, ETA lejon t\u00eb gjenden algoritma t\u00eb dob\u00ebt n\u00eb rrjet.<\/p>\n<h2>4. Analiza e anomalis\u00eb n\u00eb rrjet<\/h2>\n<p>\nCisco StealthWatch \u00ebsht\u00eb n\u00eb gjendje t\u00eb identifikoj\u00eb anomali n\u00eb trafik n\u00eb rrjet duke p\u00ebrdorur tri instrumente: <b>Ngjarje Kryesore<\/b> (ngjarjet e siguris\u00eb), <b>Ngjarje Marr\u00ebdh\u00ebniesh<\/b> (ngjarje nd\u00ebrveprimi midis segmenteve, nyjeve t\u00eb rrjetit) dhe <b>analiza e sjelljes<\/b>.<\/p>\n<p>Analiza e sjelljes, nga ana e saj, lejon nd\u00ebrtimin e nj\u00eb modeli sjelljeje p\u00ebr nj\u00eb host t\u00eb caktuar apo grup hostesh me kalimin e koh\u00ebs. Sa m\u00eb shum\u00eb trafik t\u00eb kaloj\u00eb p\u00ebrmes StealthWatch, aq m\u00eb t\u00eb sakta do t\u00eb jen\u00eb t\u00ebrheqjet fal\u00eb k\u00ebsaj analize. N\u00eb fillim, sistemi aktivizon shum\u00eb fals\u00eb alarme, k\u00ebshtu q\u00eb rregullat duhet \"t\u00eb p\u00ebrmir\u00ebsohen\" manualisht. Rekomandoj q\u00eb gjat\u00eb disa jav\u00ebve t\u00eb para mos t'i kushtoni v\u00ebmendje k\u00ebtyre ngjarjeve, pasi sistemi do ta rregulloj\u00eb vet\u00eb, ose t\u00eb shtoni n\u00eb p\u00ebrjashtime.<\/p>\n<p>M\u00eb posht\u00eb \u00ebsht\u00eb nj\u00eb shembull i nj\u00eb rregulli t\u00eb paracaktuar <i>Anomali<\/i>, i cili thot\u00eb se ngjarja do t\u00eb aktivizohet pa alarm, n\u00ebse <i>hosti n\u00eb grupin Inside Hosts nd\u00ebrvepron me grupin Inside Hosts dhe gjat\u00eb 24 or\u00ebve trafiku kalon mbi 10 megabajt<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/9f13165149dfab7e6cf5cf038e1573e5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr shembull, le t'i japim alarmit <i>Ruajtja e t\u00eb Dh\u00ebnave<\/i>, q\u00eb do t\u00eb thot\u00eb se nj\u00eb ndonj\u00eb host burimi\/destinacioni ka ngarkuar\/shkarkuar nj\u00eb sasi anormalisht t\u00eb madhe t\u00eb dh\u00ebnash nga nj\u00eb grup hostesh ose nga nj\u00eb host. Klikojm\u00eb mbi ngjarjen dhe hyjm\u00eb n\u00eb tabel\u00ebn ku tregohen hostet q\u00eb i shkaktuan. M\u00eb pas zgjedhim hostin q\u00eb na intereson n\u00eb kolon\u00eb <i>Ruajtja e t\u00eb Dh\u00ebnave<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5bac3325f9f34342802d115c4a13bf39.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/5e065344005db20d276a800d8362a347.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nParaqitet nj\u00eb ngjarje q\u00eb tregon se jan\u00eb gjetur 162,000 \"pik\u00eb\", nd\u00ebrsa politika lejon 100,000 \"pik\u00eb\" \u2014 k\u00ebto jan\u00eb metrika t\u00eb brendshme t\u00eb StealthWatch. N\u00eb kolon\u00ebn <i>Veprimet <\/i>klikojm\u00eb <i>Shiko Rjedhat<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/352df8d925fe46246a35677482d65030.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMund t\u00eb v\u00ebzhgojm\u00eb se <i>k\u00ebtu hosti<\/i> n\u00eb nat\u00eb ka nd\u00ebrvepruar me hostin <i>10.201.3.47<\/i> nga departamenti <i>Shitjet &amp; Marketingu<\/i> p\u00ebrmes protokollit <i>HTTPS <\/i>dhe ka shkarkuar <i>1.4 GB<\/i>. Ndoshta ky shembull nuk \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm n\u00eb nj\u00eb far\u00eb mase, por detektimi i nd\u00ebrveprimeve edhe p\u00ebr disa qindra gigabajt b\u00ebhet n\u00eb t\u00eb nj\u00ebjt\u00ebn m\u00ebnyr\u00eb. Prandaj, hetimi i m\u00ebtejm\u00eb i anomali mund t\u00eb \u00e7oj\u00eb n\u00eb rezultate interesante.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/923992706b36b18d2709feb444f7cf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Sh\u00ebnim<\/i>: n\u00eb nd\u00ebrfaqen e uebit SMC t\u00eb dh\u00ebnat n\u00eb skedat <i>Pultet <\/i>shfaqen vet\u00ebm p\u00ebr jav\u00ebn e fundit dhe n\u00eb sked\u00ebn <i>Monitor<\/i> p\u00ebr dy jav\u00ebt e fundit. P\u00ebr t\u00eb analizuara ngjarjet m\u00eb t\u00eb vjetra dhe p\u00ebr t\u00eb gjeneruar raporte duhet t\u00eb punoni me konsol\u00ebn java n\u00eb kompjuterin e administratorit.<\/p>\n<h2>5. Gjetja e skanimeve t\u00eb brendshme t\u00eb rrjetit<\/h2>\n<p>\nTani le t\u00eb shqyrtojm\u00eb disa shembuj t\u00eb fidan\u00ebve \u2014 incidenteve t\u00eb Siguris\u00eb Informatike. Ky funksionalitet \u00ebsht\u00eb m\u00eb i r\u00ebnd\u00ebsish\u00ebm p\u00ebr ata q\u00eb merren me sigurin\u00eb.<\/p>\n<p>Ekzistojn\u00eb disa lloje t\u00eb paracaktuar t\u00eb ngjarjeve t\u00eb skanimit n\u00eb StealthWatch:<\/p>\n<ul>\n<li>Skanimi i Portit \u2014 burimi skanon shum\u00eb porte t\u00eb hostit t\u00eb destinacionit.<\/li>\n<li>Skanimi Addr tcp \u2014 burimi skanon nj\u00eb rrjet t\u00eb t\u00ebr\u00eb p\u00ebrmes nj\u00eb porti t\u00eb vet\u00ebm TCP, duke ndryshuar adres\u00ebn IP t\u00eb destinacionit. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, burimi merr paketa TCP Reset ose nuk merr fare p\u00ebrgjigje.<\/li>\n<li>Skanimi Addr udp \u2014 burimi skanon nj\u00eb rrjet t\u00eb t\u00ebr\u00eb p\u00ebrmes nj\u00eb porti t\u00eb vet\u00ebm UDP, duke ndryshuar adres\u00ebn IP t\u00eb destinacionit. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, burimi merr paketa ICMP Port Unreachable ose nuk merr fare p\u00ebrgjigje.<\/li>\n<li>Skanimi Ping \u2014 burimi d\u00ebrgon k\u00ebrkesa ICMP n\u00eb nj\u00eb rrjet t\u00eb t\u00ebr\u00eb me q\u00ebllim k\u00ebrkimin e p\u00ebrgjigjeve.<\/li>\n<li>Skanimi Stealth t\u0441p\/udp \u2014 burimi p\u00ebrdor t\u00eb nj\u00ebjtin port p\u00ebr t'u lidhur me shum\u00eb porte n\u00eb hostin e destinacionit n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb.<\/li>\n<\/ul>\n<p>\nP\u00ebr nj\u00eb k\u00ebrkim m\u00eb t\u00eb leht\u00eb menj\u00ebher\u00eb t\u00eb t\u00eb gjith\u00eb skaner\u00ebve t\u00eb brendsh\u00ebm ekziston nj\u00eb aplikacion rrjeti p\u00ebr <i>StealthWatch \u2014 Vler\u00ebsimi i Dukshm\u00ebris\u00eb<\/i>. Duke shkuar n\u00eb sked\u00ebn <i>Pultet \u2192 Vler\u00ebsimi i Dukshm\u00ebris\u00eb \u2192 Skaner\u00ebt e Brendsh\u00ebm t\u00eb Rrjetit<\/i> do t\u00eb shihni incidente sigurie n\u00eb lidhje me skanimin p\u00ebr dy jav\u00ebt e fundit.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/eb72d246b44752e8441afd500178fc02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke klikuar mbi butonin <i>Detajet<\/i>, do t\u00eb shikohet fillimi i skanimit t\u00eb \u00e7do rrjeti, treni i trafikut dhe alarmet p\u00ebrkat\u00ebs.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/b4ef9ec46040cdab026b83d03eda615f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas mund t\u00eb \u201cthelloheni\u201d n\u00eb host nga karta n\u00eb screenshot-in e m\u00ebparsh\u00ebm dhe t\u00eb shihni ngjarjet e siguris\u00eb, si dhe aktivitetin p\u00ebr jav\u00ebn e fundit p\u00ebr k\u00ebt\u00eb host.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7f8d57e2d29930fcd5febf5a44cca714.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/7ce0e489618c072958a3416e342900eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi nj\u00eb shembull, do t\u00eb analizojm\u00eb ngjarjen <i>Skandimi i Portit<\/i> nga hosti <i>10.201.3.149<\/i> n\u00eb <i>10.201.0.72<\/i>, duke klikuar n\u00eb <i>Veprat &gt; Flukset e lidhura<\/i>. Nis nj\u00eb k\u00ebrkim p\u00ebr flukset dhe jep informacionet relevante.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/07f86540fae01171c8dfea68c8451a47.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi\u00e7 e shohim, ky host nga nj\u00eb port i tij <i>51508\/TCP<\/i> skanoi para 3 or\u00ebsh hostin e destinuar n\u00eb portet<i> 22, 28, 42, 41, 36, 40 (TCP)<\/i>. Disa fusha nuk shfaqin informacion ose p\u00ebr shkak se jo t\u00eb gjitha fushat Netflow mb\u00ebshteten n\u00eb eksportuesin Netflow.<\/p>\n<h2>6. Analiza e malware-ve t\u00eb shkarkuar me CTA<\/h2>\n<p>\n<b>CTA (Analiza Kognitive e K\u00ebrc\u00ebnimeve)<\/b> \u2014 analitika cloud Cisco, e cila integrohet shk\u00eblqyer me Cisco StealthWatch dhe lejon t\u00eb plot\u00ebsohet analiza pa n\u00ebnshkrim me at\u00eb sipas n\u00ebnshkrimeve. K\u00ebshtu b\u00ebhet e mundur zbulimi i trojan\u00ebve, worms rrjet\u00eb, malware-ve t\u00eb dit\u00ebs zero dhe malware-ve t\u00eb tjera dhe shp\u00ebrndarja e tyre brenda rrjetit. Gjithashtu, teknologjia e p\u00ebrmendur m\u00eb par\u00eb ETA lejon t\u00eb analizohet komunikimet e tilla t\u00eb d\u00ebmshme edhe n\u00eb trafik t\u00eb enkriptuar.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/68d86dc9686e2f0c754181db73411ab8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb pakt\u00ebn n\u00eb kart\u00ebn e par\u00eb n\u00eb nd\u00ebrfaqen web, ka nj\u00eb widget t\u00eb ve\u00e7ant\u00eb <i>Analiza Kognitive e K\u00ebrc\u00ebnimeve<\/i>. P\u00ebrshtypja e shkurt\u00ebr tregon p\u00ebr k\u00ebrc\u00ebnimet e zbuluara n\u00eb hostet e p\u00ebrdoruesve: trojan, malware mashtrues, malware reklamues t\u00eb bezdissh\u00ebm. Fjala \u201cE Enkriptuar\u201d \u00ebsht\u00eb d\u00ebshmia e funksionit t\u00eb ETA. Duke klikuar n\u00eb host, shfaqet t\u00eb gjitha informacionet, ngjarjet e siguris\u00eb duke p\u00ebrfshir\u00eb log-\u00ebt p\u00ebr CTA.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a49a2ae655c1dfa89cdcb194c8f38c51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/f6bbe9585060ecb46712584924125fa3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke kaluar mbi \u00e7do hap CTA, ngjarjet ofrojn\u00eb informacion t\u00eb detajuar mbi nd\u00ebrveprimin. P\u00ebr nj\u00eb analiz\u00eb t\u00eb plot\u00eb, duhet t\u00eb klikoni mbi <i>Shiko Detajet e Ngjarjeve<\/i>, dhe do t\u00eb hyni n\u00eb nj\u00eb konsol\u00eb t\u00eb ve\u00e7ant\u00eb <i>Analiza Kognitive e K\u00ebrc\u00ebnimeve<\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/8737a4da2133ee4b72e830f9208f4d11.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebndin e sip\u00ebrm t\u00eb djatht\u00eb, filtrimi lejon t\u00eb shfaqet ngjarjet sipas nivelit t\u00eb kriticitetit. Duke kaluar mbi nj\u00eb anomali t\u00eb c\u1ee5nt, n\u00eb fund t\u00eb ekranit shfaqen log-et me p\u00ebrkat\u00ebsin e tij n\u00eb t\u00eb djatht\u00eb. K\u00ebshtu, specialisti i departamentit t\u00eb siguris\u00eb informon qart\u00eb se cili host i infektuar filloi t\u00eb kryej\u00eb cilat veprime pas cilave veprime.<\/p>\n<p>M\u00eb posht\u00eb \u00ebsht\u00eb nj\u00eb shembull tjet\u00ebr \u2014 trojani bankar, me t\u00eb cilin ishte infektuar hosti <i>198.19.30.36<\/i>. Ky host filloi t\u00eb nd\u00ebrveproj\u00eb me domainet e d\u00ebmshme, dhe n\u00eb log-\u00ebt shfaqet informacioni mbi flukset e k\u00ebtyre nd\u00ebrveprimeve. <\/p>\n<p><img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/d5faba6e8ec2addff8e18b83548e65fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3\" src=\"\/wp-content\/uploads\/2020\/07\/a5f880407468b6fc62805d68c2d672cb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNj\u00eb nga zgjidhjet m\u00eb t\u00eb mira q\u00eb mund t\u00eb jet\u00eb, \u00ebsht\u00eb t\u00eb izoloni host-in fal\u00eb Cisco ISE p\u00ebr trajtim dhe analiz\u00eb t\u00eb m\u00ebtejshme. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511726\/\">integrimin <\/a><\/noindex>me Cisco ISE p\u00ebr trajtim dhe analiz\u00eb t\u00eb m\u00ebtejshme. <\/p>\n<h2>P\u00ebrfundim<\/h2>\n<p>\nZgjidhja Cisco StealthWatch \u00ebsht\u00eb nj\u00eb nga lider\u00ebt n\u00eb produktet p\u00ebr monitorimin e rrjetit, si nga pik\u00ebpamja e analiz\u00ebs s\u00eb rrjetit ashtu edhe t\u00eb siguris\u00eb informative. Ajo mund\u00ebson zb\u00ebrthimin e interakteve ilegjitime brenda rrjetit, vonesave t\u00eb aplikacioneve, p\u00ebrdoruesve m\u00eb aktiv\u00eb, anomali, malware dhe APT. M\u00eb tej, mund t\u00eb identifikoni skanimet, pentester\u00ebt, t\u00eb kryeni auditime t\u00eb kriptografis\u00eb n\u00eb trafikun HTTPS. M\u00eb shum\u00eb raste p\u00ebrdorimi mund t\u00eb gjeni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/cisco.bravais.com\/s\/lnmF3Eowwg51t7Rj9DtD\">linkun<\/a><\/noindex>.<\/p>\n<p>N\u00ebse d\u00ebshironi t\u00eb kontrolloni sa mir\u00eb dhe n\u00eb m\u00ebnyr\u00eb efikase funksionon rrjeti juaj, d\u00ebrgoni <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/cisco\/cisco-stealthwatch\">k\u00ebrkes\u00eb<\/a><\/noindex>. <br \/>\nN\u00eb periudh\u00ebn n\u00eb vijim planifikojm\u00eb disa publikime teknike mbi produkte t\u00eb ndryshme t\u00eb siguris\u00eb informative. N\u00ebse jeni t\u00eb interesuar p\u00ebr k\u00ebt\u00eb tem\u00eb, ndiqni p\u00ebrdit\u00ebsimet n\u00eb kanalet tona (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogu i Zgjidhjeve TS<\/a><\/noindex>)!<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/509812\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Cisco StealthWatch \u2014 \u044d\u0442\u043e \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435\u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0443\u0433\u0440\u043e\u0437 \u0432 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0440\u0430\u0431\u043e\u0442\u044b StealthWatch \u043b\u0435\u0436\u0438\u0442 \u0441\u0431\u043e\u0440 NetFlow \u0438 IPFIX \u0441 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0441\u0435\u0442\u044c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0447\u0443\u0432\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u043d\u0441\u043e\u0440\u043e\u043c \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0443 \u0437\u0430\u0433\u043b\u044f\u043d\u0443\u0442\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u0435\u0442\u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Next Generation [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90229,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90228","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-07-29T23:42:34+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47StealthWatch: analiza dhe hetimi i incidenteve. Pjesa 3 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47StealthWatch: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432. \u0427\u0430\u0441\u0442\u044c 3 | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/stealthwatch-analiz-i-rassledovanie-inczidentov-chast-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-29T23:42:34+00:00","article:modified_time":"2020-07-29T23:42:34+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90228","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:55:29","updated":"2022-10-02 06:01:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=90228"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90228\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/90229"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=90228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=90228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=90228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}