A Day in the Life Demo Version History

Summary:

This process appears to be focused on using ArcSight, a security information and event management (SIEM) tool, to monitor and manage assets within an organization. Here's a more detailed breakdown of the key steps and functions described in your text: 1. **Asset Management**: - The user accesses asset information through specific paths in the DAC grid and requests Scanner Reports for particular systems like "oradb01" from ArcNet Assets. - Detailed categorization is provided, including operating system details, patch levels, and application information. - Asset Criticality Categories are assigned based on factors such as vulnerability, open port information, and historical attack data. This helps in prioritizing assets for further attention. 2. **Vulnerability Management**: - A severe vulnerability is detected on the system "hkfinancial," which handles regulated data. - An automated case is generated to investigate this issue, with a focus on addressing vulnerabilities that should not be present at such a level of severity. - The user can track and manage this case through ArcSight's Case Management feature, allowing for real-time monitoring and response to potential threats. 3. **Workflow and Collaboration**: - Specific events are selected based on predefined criteria related to the SIEM tool. - A workflow is set up to handle interactions with the SIEM tool efficiently, facilitating collaboration among team members within the organization. 4. **Event Correlation**: - The vulnerability data is used by ArcSight's advanced analytics and reporting capabilities to quickly identify and respond to threats targeting critical assets that are also regulated or compliant. - This helps in real-time threat detection, enhancing the overall security posture of the organization. 5. **Compliance and Reporting**: - The integration of vulnerability data with ArcSight's advanced analytics allows organizations to effectively manage compliance with HIPAA and other regulatory standards. - It satisfies auditors’ requirements for due diligence by providing transparent and accountable risk management practices. - Continuous improvement in corporate risk management is demonstrated through the ongoing monitoring and mitigation of vulnerabilities as they are identified. 6. **Operational Framework**: - Users can annotate events, set them to different stages, and assign them to administrators or self-assign based on their urgency. - The system allows for easy tracking and interaction with these events through a designated channel called "My Open Events Channel." 7. **ArcSight Discovery**: - This feature uses advanced data mining techniques to identify potential security concerns by detecting repeated behavioral patterns across various events. - It helps in flipping from rule-based handling to real-time monitoring, crucial for addressing unknown threats and vulnerabilities that emerge daily. - The "Discovery Profile" can be configured with specific parameters such as minimum pattern length and occurrences to tailor detection to known or suspected threat types like worms or vulnerabilities. 8. **Execution of Discovery**: - After setting up a profile, the system runs it to identify repeated behaviors that might indicate potential security issues. 9. **Visual Representation of Workflow**: - The workflow is visually represented by a tree structure, allowing users to navigate and observe various behaviors within the data or processes being analyzed. By summarizing these points, you can see how ArcSight is utilized for comprehensive asset management, vulnerability monitoring, compliance tracking, real-time threat detection, and operational efficiency through advanced analytics and workflow management capabilities.

Details:

This document provides a comprehensive set of demonstration scripts for various scenarios, designed to help users tailor their demonstrations according to their prospects' needs. The document includes a table of contents that outlines different sections such as perimeter attack scenarios, insider threat scenarios, and compliance scenarios. Each scenario is described with specific steps in the form of demo scripts. The general suggestions within this document include optimizing system performance by disabling certain features like on-access scanning for better application load times and simplifying the user interface by closing unnecessary panels and tabs. The tips are practical for creating a focused environment during demonstrations, making it easier to demonstrate the product's capabilities effectively. This document outlines general startup instructions and provides updates for a demonstration system using Placeware, ArcSight, and Oracle databases. It emphasizes maintaining a clean, simple interface and suggests specific resolutions for better performance. Key points include ensuring the system is plugged in for optimal demo running, keeping Acrobat minimized for faster access to archived reports, setting the maximum resolution of 1280x1024 for Placeware demos, instructing customers to hide panels for maximized screen real estate, starting Oracle database and listener services manually or using provided icons, enabling specific event files for demonstration purposes, and periodically refreshing the demo system by rerunning the installer. The document also highlights improvements in demo scripts' structure and content, along with introducing new events files and scenarios. This document outlines the details and implications of running live demonstrations for a software product, specifically focusing on the use of dashboards and reports within this context. The demonstration involves utilizing pre-loaded event files that are not permanently stored in the system; instead, they are loaded dynamically at the start of each manager session. The demo starts at 18:21:00 on November 22, 2004, and concludes at 20:28:00. It is important to note that due to the dynamic nature of dashboard refreshing with every manager start, any data displayed in these dashboards will be current only during the active session. To view live data in the dashboards, it is necessary to run demo event files during each demonstration. This ensures that all reports and generated data are up-to-date at the time of viewing. Delta reports can be particularly useful for observing trends over small intervals such as from 18:21 to 19:21 and then from 19:21 to 20:28. The demo does not require configuration of specific start or end times, nor the setup of a scanner agent for generating reports. ArcNet archived reports also do not need pre-set time configurations, although minor adjustments might be necessary in Internet Explorer (IE) for proper report loading. For pattern discovery profiles and vulnerability scans, running live demo events is crucial as it directly impacts what data is presented on the dashboards and executive level content such as compliance systems by type of attack, count of vulnerabilities, attacked revenue generating systems, and Sarbanes Oxley top targets. In terms of dashboard visualization for executives (CEO view), the demonstration provides a detailed overview of attacks categorized by location, business role of assets, systems compromised, and types of system targeted based on vulnerability status and whether they generate revenue. Compliance with regulations like Sarbanes Oxley is also monitored through delta reports that show changes in attack trends over time. Lastly, some hints for navigating the demo include using customized views of live security events through channels and dashboards, where filters can be adjusted according to specific requirements or patterns observed during the demonstration. This approach allows users to interactively explore different aspects of the event data as they evolve throughout the session. The provided text describes a security incident involving an ArcSight system, which is used for cross-device correlation of intrusion detection systems (IDS) and firewall traffic. The scenario involves a buffer overflow attack exploiting the .printer vulnerability on an IIS web server through port 80, as detected by Snort IDS. This triggers a high priority event in ArcSight due to a compromised target. The Check Point Firewall confirms this with "Action:accept" for both HTTP (port 80) and FTP sessions from the compromised system. Due to the comprehensive data capture provided by ArcSight, it correlates low-priority firewall events with the high-priority IDS event, presenting a unified view of the attack. The visualization tool in ArcSight helps in diagnosing the progression of the attack easily. To manage this scenario effectively, modify the rule's action to create a new case named "Part 3 Attack Succeeds - Compromised Target," changing its status from "Successful Attack - A Priority Target" and assigning it to the "Admins Open Cases" group. This helps in organizing and tracking the incident flow efficiently. The provided document outlines a scenario where a security analyst, while not physically present at their workplace, receives an alert regarding a high priority event involving a compromised target. This incident involves an external attacker attempting to access a system through IP addresses .149 and .119. The attack is being reported by devices using Snort and Check Point FW as detection tools. The analyst follows these steps upon receiving the alert: 1. **Acknowledge the Event**: Using ArcSight Web, the analyst acknowledges the event to ensure it doesn't automatically escalate to higher authorities after a set time period. 2. **Review Event Details**: The analyst accesses MyArcSight to view detailed information about the compromised system and the attacker’s IP address. 3. **Case Management**:

• Reference the case titled "Part 3 Attack Succeeds – Compromised Target" which has been automatically generated based on triggered rules.

• Update the case status from "Queued" to "Initial".

• Adjust operational impact and consequence severity settings to reflect the critical nature of the incident (Immediate Impact, Critical Severity).

• Provide a description summarizing the attack type and its implications.

• Identify the attacker as an outsider by changing the "Attack Agent" setting accordingly.

4. **Action**: Implement B-Block/Shutdown actions on the session to mitigate further threats. This workflow demonstrates the use of automated case management in ArcSight for tracking cyber incidents, emphasizing the importance of timely acknowledgment and handling high-priority events. This document describes an incident response process using ArcSight Console, a security monitoring tool, following the detection of an attacker's buffer overflow attack via IDS on port 80. The steps include accessing and navigating through various dashboards and grids within ArcSight Console to investigate the event in detail. 1. **Investigation**:

• Utilize the Target IP datamonitor to find specific IP addresses, such as .149 and .21, which are critical for further investigation.

• Change the representation of data from a 3d chart to a grid format for better visualization and drill down into detailed events.

• Use the ArcSight Console Grid to select high-priority events and specifically review the Part 3 Rule for insights. The rule reveals that an attacker launched a buffer overflow attack identified by IDS on port 80, which was accessed via HTTP (port 80) from the public IP .149 to the target's PUBLIC IP address.

2. **Network Analysis**:

• Observe the network traffic flow: see how 10.0.20.21 communicates out through the firewall back to the attacker’s IP 199.248.65.119, indicating an FTP session potentially transporting critical files. This communication is crucial as Check Point captures translated address information confirming that both public (.149) and private (.21) addresses are associated with the same host.

3. **Case Management**:

• Append the case automatically generated by this event to track the status of the incident, including timely remediation and reporting.

• Highlight specific events in the grid and select "Rule Options – Show Triggering Resource" to understand the rule actions and how they are applied during the investigation process.

4. **Security Measures**:

• Ensure that all identified events are highlighted for further review, especially focusing on rule actions such as "Send to Console," which facilitates communication of event details within the security console for further action.

This detailed report is essential for understanding and managing the consequences of cyber-attacks, providing a structured approach to investigate potential breaches and take necessary remedial measures. The provided text outlines a demonstration scenario using ArcSight, a security information and event management (SIEM) tool, to handle an attack in progress involving a known vulnerable asset. The scenario involves creating cases within the ArcSight Console for automated incident handling. 1. **Creating a Case**: A case is created automatically based on specific rules triggered by events such as an attacker being added to the Attacker active list and a compromised host being added to the Compromised Host active list. This showcases the tool's ability to automate processes effectively, potentially reducing manual workload and enhancing response times. 2. **Case Management**: The case is managed within the ArcSight Console, specifically referred to as "Part 3 Attack Succeeds – Compromised Target." Actions taken in this case include placing a firewall rule to deny all outbound FTP sessions. The initial stage of the case is transitioned from "Initial" to "Closed," and the case is submitted. 3. **Rule Modification**: Prior to running the demonstration, it is advised to modify an existing rule called "Attack in Progress – Known Vulnerable Asset" by adding a notification to its action tab. This modification helps in prioritizing attacks on vulnerable assets, thereby reducing false positives and dead-end investigations. 4. **Benefits**: The advanced correlation capabilities of ArcSight enable it to prioritize attacks against vulnerable assets, which is beneficial in reducing the occurrence of false positives and dead ends in investigations. This efficiency translates into a quicker Return on Investment (ROI) and lower Total Cost of Ownership (TCO). 5. **Demo Completion**: At the conclusion of the demonstration, the scenario should be reviewed with questions from participants to ensure understanding and engagement. The text also highlights how ArcSight uses asset vulnerability information from Nessus to set priorities for events like "Attack in Progress – Known Vulnerable Asset," which helps in focusing on high-priority threats while minimizing less critical issues. The provided summary outlines a scenario involving three distinct cyber-attacks, each targeting assets with known vulnerabilities. These attacks are characterized by their use of buffer overflow exploits and are associated with specific CVE references. The attacks involve exploiting a file with a .idc extension through an IIS server, as detected by Snort and subsequently confirmed by ArcSight. **Attack Details:** 1. **Type**: Buffer Overflow Exploit 2. **Affected File Extension**: .idc 3. **Targeted Asset**: Known Vulnerable (CVE-referenced) 4. **Port Used**: 80 (HTTP, typically for web servers like IIS) 5. **Attack Source IP**: 205.219.84.9 6. **Severity**: High (Severity of 8 on a scale where 10 is the highest) 7. **Relevance Value**: 10, indicating high priority due to known vulnerabilities and open ports. **Detection and Response:**

• The attack was detected by Snort, which flagged repeated attempts to exploit an IIS server.

• ArcSight identified the target (98.148) as vulnerable to this specific WebIIS attack.

• Based on this information, ArcSight automatically triggered a rule "Attack in Progress – Known Vulnerable Asset."

• This rule is designed to detect attacks against known vulnerable assets and operates under the principle that knowing open ports and vulnerabilities helps assess the likelihood of successful exploitation.

**Technical Tools Used:**

• **IDS**: Snort (for initial detection)

• **Vulnerability Scanner**: Nessus (though not explicitly mentioned in the provided text, it is implied from the context of CVE references and vulnerability scanning)

• **SIEM Tool**: ArcSight for correlation and rule triggering.

**Organizational Impact:**

• The attacks are linked to specific assets that have been identified as vulnerable through a combination of IDS alerts, vulnerability scans, and direct knowledge of known exploits in the field (indicated by being part of "All Active Lists").

• The use of ArcSight allowed for rapid identification and prioritization of potential threats.

**Case Management:**

• A dedicated case was opened: "Attack on Vulnerable Asset."

• Security Analysts can access this information through a dashboard specifically designed for training purposes, allowing them to manage alerts efficiently during incidents.

This workflow demonstrates the integration of various security tools and processes at an organization level, enabling swift response to ongoing cyber threats targeting known vulnerable systems. This text is about using ArcSight, a system for monitoring cyber attacks, to manage an ongoing attack. Here's a summary of what it discusses: 1. **Automatic Escalation**: The system has built-in features for notifying higher levels of personnel if no action is taken regarding an event. This prevents important issues from being overlooked and ensures that they are handled with the appropriate urgency. 2. **Event Details**:

• The attacked IP address is 209.129.98.248.

• The attacker's IP address is 205.219.84.9.

• Events are being reported by Snort and ArcSight Web Case Management systems.

3. **Case Management**:

• A case named "Attack in Progress – Known Vulnerable Asset" is automatically generated when certain rules are triggered. This automated creation is crucial for tracking incidents effectively during cyber investigations.

• The stages of the case can be managed, with the stage initially set to "Queued." Changing it to "Initial" starts the case management process and makes it visible to others.

4. **Severity Settings**:

• Operational Impact is set to "4-Immediate Impact," indicating high urgency.

• Consequence Severity is rated as "3-Critical," signifying a severe consequence if left unresolved.

• A description like "Outside threat to a critical system" and the attacker being categorized as "Outsider" are added for clarity. The action taken against the attacker is "B-Block/Shutdown."

5. **Investigation**:

• Transition to the ArcSight Console for further investigation, where the event is continuously tracked and managed. This ensures timely resolution, status reporting, and tracking of the incident.

6. **Dashboard and Visualization**:

• The ArcSight Console includes a Training Dashboard that provides visual access to monitored events with "one-click" functionality.

• Using the Target IP datamonitor, specific details like the .148 IP address can be visualized in charts (e.g., changing from a bar chart to a 3D chart).

• Drilling down into detailed views (like the .148 IP address) provides a grid view where high-priority events can be selected and further analyzed.

Overall, this process outlines how ArcSight is used to efficiently handle and track cyber threats, ensuring swift action and proper management of critical incidents. The "Nerfable Asset" Rule is a methodology used in cybersecurity to assess the risk associated with an asset based on various factors. These include how well we know about the asset (Model Confidence), its history of being scanned for vulnerabilities or open ports (Scanner report in the ArcSight DB, Scanned for Ports, Scanned for Vulnerabilities), and whether there's a history of attacks or compromises involving that asset (Severity). This assessment is crucial for determining an asset's criticality and relevance to the organization. **THREAT fields** are used to measure the level of threat posed by an asset: 1. **Model Confidence**: This field evaluates how well we understand the asset. It involves factors like whether the asset has been scanned for open ports or vulnerabilities, with each factor contributing a maximum score of 4 (up to a total of 10). A higher score indicates better knowledge about the asset. 2. **Severity**: This is a historical context value that assesses the likelihood of past attacks or compromises involving the asset. Factors here include whether the asset has been identified on a list of hostile attackers, compromised targets, locations where the asset was attacked in suspicious manners, or as part of reconnaissance activities. 3. **Relevance**: This field evaluates the direct connection between the asset and potential vulnerabilities. It includes factors such as whether specific ports are open on the system and if there is evidence that the asset is vulnerable to attack. Each of these contributes a score of 5. 4. **Asset Criticality**: This factor considers how important the asset is to the organization, including its value in terms of exploited vulnerabilities and potential impact on other vulnerable assets. The process transitions into case management within the ArcSight Console. When a rule triggers, an "Attack in Progress - Known Vulnerable Asset" case is automatically created. Actions taken might include patching the vulnerability, with stages changing from "Initial" to "Closed." This scenario is part of a perimeter security demonstration that involves compromised VPN accounts and physical access via badge reader systems. The benefits of this approach are highlighted as its ability to correlate activities across different security domains, including both physical and digital assets. The provided text outlines a scenario involving network security within an organization, specifically in the context of monitoring and alerting on potential threats such as compromised user accounts. Here's a summary of the key points mentioned: 1. **Event Details**:

• Event Type: Physical VPN (PHYSVpn:0-40)

• Source: Badge Reader (mock-up) and Cisco VPN

• Rule Triggered: Insider thread – compromised VPN Account, Insider Threat – Attack from VPN address pool (triggered by p2p traffic disallowed within ArcNet)

• Active List: Compromised User Accounts

2. **Reporting**:

• Reports can be found under specific sections in the ArcNet system, such as "Activity Involving Compromised User Accounts" and "Hosts Accessed By Compromised User Accounts".

3. **Demo Workflow**:

• The user is an Operator in a SOC or NOC monitoring center, responsible for first-line monitoring and alerting of potential threats.

• Using the "Heads Up & Port Anomaly" dashboard to identify compromised machines (e.g., machine "10.0.112.60").

• Double-clicking on this entry leads to a grid view with correlated events, where lightning strikes indicate correlation.

• ArcSight uses 3-D Correlation based on event flow, normalization into an internal language, and vulnerability assessment data for analysis.

This summary captures the primary elements of the described process, including how compromised accounts are identified, reported, and investigated using available tools in the SOC environment. The passage discusses the use of three factors in determining the relevance of an attack and reducing false positive alarms using ArcSight's capabilities. These factors include verifying whether a specific port is open on the asset being targeted, assessing the value or criticality of the asset within the enterprise, and examining historical data through VA (Vulnerability Assessment) to determine the likelihood of potential attacks. ArcSight has an internal asset database that can be linked with internal asset management systems, allowing assets to be assigned a value indicating their worth or criticality to the organization. By considering these three factors together, 3D Correlation significantly reduces the number of false positive alarms generated by reducing the likelihood of irrelevant attacks being prioritized. The passage then describes an example scenario where multiple instances of a correlated event occur due to data looping in the demo environment. The process involves selecting events and using Rule Options / Detailed Chain to investigate further, ultimately revealing that someone attempted to log in as user "brian" five times, leading to a chain of related events being detected. The passage concludes by highlighting the flexibility of the ArcSight Java console, which allows for quick changes in investigation focus from IP addresses to specific user activities simply by selecting and creating filters based on target user names. The example provided emphasizes how easy it is to narrow down investigations using this tool after initially seeing a lack of interesting content due to time constraints or initial findings. To summarize the given information about extending the time period displayed in a demo related to an Event Graph using ArcSight: 1. **Extending Time Period**: You extend the duration shown on the event graph by selecting a wider time slice, which typically ranges from now back to one hour ($now -> $now-1h). This extended view allows for more events to be displayed, showcasing filters and their usability effectively. 2. **Displaying Events**: After extending the time period, you should see 21 events on display. To better analyze these events, select all of them and redisplay an event graph. The expanded graph will provide a clearer view with additional information. 3. **Event Graph Display Types**: ArcSight offers four types of displaying event graphs: Hierarchical, Organic, Circular, and Orthogonal. For specific types of attacks, different views are more effective. For instance, the Circular view is ideal for horizontal port scans that visually demonstrate the attack's nature. 4. **Color and Size Interpretation**:

• **Squares**: Represent machines. A red square indicates an attacker, a white square represents a machine under attack, and a blue square denotes a machine acting as both target and source of new attacks.

• **Circles**: Symbolize actions or events. The size of these objects is proportional to the number of related events; larger objects indicate more associated events. In the example provided:

• Device 10.0.112.60 shows multiple events, being attacked by both 10.0.114.25 and 63.22.124.56.

• **Color Interpretation**: Helps in identifying roles (attacker vs. target) without relying on size alone.

5. **Related Series of Events**: On the left side, you observe:

• User "brian" accessing the network over VPN, flagged as a compromised user account by the Kerio Card Reader system.

• A brute force logon attempt followed by successful password change by the attacker.

6. **Actions by Attacker**: The right-hand side of the event graph displays actions taken by the attacker. This summary encapsulates the process and visual elements used in extending time, selecting events, interpreting graphs, and understanding related series of events as demonstrated through ArcSight tools for cybersecurity analysis. After a target machine is compromised, follow these steps to manage and report the incident: 1. **Open a Trouble Ticket:** Create a ticket in the trouble ticketing system and assign it to an Enterprise Security Analyst. 2. **Add Events to the Case:** In the event graph, right-click on all selected events and choose "Add to Case." 3. **Assign the Case Owner:** Ensure another user is created and assigned as the owner of the case in the Initial tab. Provide a suitable name for the case (e.g., "Compromised VPN account"), set the stage to "initial," operational impact to level 3, and assign the owner to another user. 4. **Close the Inspect Window:** Return to the Grid display after completing these steps. 5. **Report to Senior Management:** As part of your role, report any security breach by running a static report. Use the "Activity Involving Compromised User Accounts" report and optionally the "Hosts Accessed by Compromised User Accounts" report to identify compromised accounts. Additionally, for perimeter scenario management:

• **Zero-day Worm Outbreak:** Utilize rules and moving average data monitors to detect worm outbreaks without waiting for IDS signatures. ArcSight provides real-time notifications and a list of affected systems for proactive isolation and remediation.

This document outlines the details related to a zero-day worm outbreak, focusing on its detection and monitoring using specific tools and technologies such as Unix Logs, Netscreen & Pix Firewall, and Cisco Routers. The documentation provides detailed steps for setting up and refreshing a dashboard dedicated to tracking this malware's spread across various systems and networks. The primary components of the document include:

• **Event Sources**: Specifies that the worm spreads through Unix Logs, Netscreen & Pix Firewall, and Cisco Routers.

• **Rules**: Describes the outbreak as a "Zero Day Worm" with no specific details on rules implemented for detection.

• **Reports**: Not applicable in this case, presumably because the document is focused on real-time monitoring tools.

• **Dashboard**: Features two main data monitors:

• **Worm spread by system** displays how the worm spreads via IP addresses to identify infected systems quickly.

• **Worm spread by logical network** shows the geographical or functional distribution of affected zones, aiding in quick identification of infected areas.

• Additional monitor **Moving average spike** tracks rule firings related to worm activity status.

• **Worm infected systems**: Lists all systems known to be infected by the worm.

• **Active List**: Focuses on "Worm Infected System."

• **Setup Steps**: Provides detailed instructions for renaming a channel, setting up the Zero Day Worm Outbreak dashboard, and configuring the replay agent with specific settings (200 events per minute).

• **Refresh Steps**: Explains how to reset data monitors by disabling and re-enabling them within the real-time event viewer.

This document is crucial for IT security teams dealing with advanced persistent threats like zero-day worms, providing a structured approach to monitor and respond effectively to such outbreaks using available technological tools. As a security analyst, you receive an urgent email from ArcSight alerting you to a Zero Day Worm Outbreak. The worm has already spread to multiple systems, making it imperative for you to quickly assess the situation, verify the attack, and identify infected systems for remediation. To start, recall that last month, you set up a specific correlation rule in ArcSight which triggers an alert if: 1. A target host shows a 100% spike in activity on a particular port. 2. The same target host also targets at least 10 different hosts using the same port. This rule captures events from various sources such as UNIX logs, Firewall logs, and Router events. To visualize and analyze this event data: 1. You activate a sample event flow within ArcSight to replay events that could have led up to the outbreak notification. This feature allows you to simulate real-time events for testing purposes, although in a live environment, you can utilize over 100 pre-built SmartAgents for efficient data collection. 2. Upon reaching the dashboard console, you observe various color-coded indicators that represent different types of events:

• Red squares denote the source of the attack.

• Blue circles signify the normal occurrence of events.

• White squares indicate target hosts before they were infected.

• Blue squares now show as infected and are acting as attackers, having undergone a significant change in their status during the replay process.

3. The spike in target port activity is clearly marked on the dashboard, with red squares indicating the initial source of infection followed by blue circles showing subsequent infections across multiple systems. This demonstration illustrates how you would use ArcSight to quickly identify and respond to a Zero Day Worm Outbreak, highlighting its importance for real-time monitoring and analysis in cybersecurity operations. The provided text describes various steps and features of an application used to monitor network security, specifically focusing on detecting and visualizing a "worm" attack. Here's a summarized version of the key points mentioned in the text: 1. **Activity by Attacker Panel**: This feature displays two lines—a yellow moving average line and a green current activity level indicator. The user should observe that there is an increase in activity indicated by the green line, which stands out from the moving average (yellow line). 2. **Worm Spread by System Panel**: Users are shown a circular layout graph where they can visually assess the scale of the attack across different systems within the network. 3. **Interacting with the Interface**:

• To un-dock and double-click on the data monitor header to view detailed items, which may include setup options for drill-down capabilities if enabled in the dashboard settings.

• To re-dock the data monitor, click the third icon from the right at the top of the window or navigate through Window/Floating options if the data monitor is not visible.

4. **Worm Spread by Logical Network Panel**:

• Users detach this window to get a sense of how deeply the worm has penetrated the network.

• By drilling in and scrolling from attacker to target systems, users can trace the path of the worm through different network zones including Hong Kong external and internal zones, and eventually reaching San Jose.

5. **Worm Infected Systems Panel**: This panel highlights critical systems previously identified as infected, requiring immediate attention. 6. **Worm Activity Status Panel**:

• Users can double-click on status lines to view detailed event inspector windows showing fired correlation rules and their priorities: Spike (3), Multiple Targets (7), Zero Day Worm (10).

7. **Benefits**: ArcSight Dashboards allow for quick, intuitive understanding of the attack's scope and then pinpoint high-priority events for further investigation. 8. **Real-Time Event Viewer**: This feature provides a different perspective on worm activity by visualizing real-time data directly from the network monitoring tools. In summary, this text is about using an application to monitor and visualize a computer worm attack within a network, explaining features such as panel displays, user interactions, detailed views, and benefits of the system in place for managing security events efficiently. The text describes an interface in a system, likely part of a security or monitoring platform, which allows users to filter events based on priority and view detailed information about specific rules and their actions. Key features include: 1. **Filtering Mechanism**: Users can focus on critical events by filtering through the "Very High Priority Event Counter" at the top of the interface. This helps in concentrating on significant issues only, potentially reducing clutter from lower priority or false positive alerts. 2. **Detailed Chain of Events**: By double-clicking specific event details (like a Zero Day Worm Outbreak Detected rule), users can access detailed historical information about how and why that rule was triggered. This includes viewing the sequence of events leading up to the rule being activated, which is crucial for forensic analysis. 3. **Drill to Rule**: Users have the ability to view specific details of a fired rule by highlighting its name and selecting options such as "Show Detailed Chain" or "Show Triggering Resource". This provides transparency into the rule's configuration and execution context. 4. **Current Rule Actions**: The interface allows users to inspect the actions taken when a rule is activated, including notifications via email (showing how security analysts are alerted) and setting priority levels for correlated events. Users can also explore additional possible actions like opening cases in ArcSight or external systems, executing custom scripts, or calling remediation scripts. 5. **Benefits**: The system provides benefits such as automatic action following rule activations which can significantly reduce the time to address security incidents and the number of affected systems. This is particularly important for handling real-time threats effectively without manual intervention. 6. **Active List**: Finally, this setup demonstrates how users can interact with an "active list" where they can manage ongoing security events and take appropriate actions based on priority and rule configurations. Overall, the interface supports efficient monitoring of critical security alerts, detailed analysis for incident response, and automated action in a secured environment. The article discusses how an ArcSight analyst received a notification email and quickly diagnosed a problem related to an infected system, specifically a worm outbreak spreading across the network. To address this issue, the analyst decided to identify the infected systems and create a notification by selecting "add to infected list" from ArcSight's capabilities for automation remediation. The process involves navigating through specific lists within ArcSight to find the active list named "Worm Infected Systems." Right-clicking on this list will display details of all the infected systems that need attention. With this information, the security analyst can now quickly remediate the infected systems and stop the worm outbreak, which has been visualized in real-time through advanced correlation rules and actions such as notifications and active list management within ArcSight. This method not only improves efficiency but also allows for quick identification of zero day worm outbreaks, making it a valuable tool for security analysts tasked with handling virus spread scenarios like a perimeter scenario or virus outbreak where swift action is crucial. The benefits mentioned include the ability to visualize the network's spread of viruses and identify infected machines in real-time, thereby reducing remediation time significantly. This approach ensures that high priority security events are addressed first while effectively managing the infection list to stop further spread. The provided text outlines the functionality and setup process for a Virus Activity Dashboard used in monitoring and analyzing virus occurrences within network systems. Key features include displaying trends over time (for both networks and individual hosts), highlighting the severity of virus incidents, and prioritizing cleaning efforts based on frequency and impact. The dashboard itself is designed to provide real-time insights into affected networks, hosts, and viruses, using graphical representations such as red boxes for impacted networks, green circles for hosts, and white boxes indicating the number of times a virus has appeared (with larger boxes signifying higher occurrences). This visual data helps IT and security teams quickly identify which systems are most in need of virus removal. To use the dashboard: 1. Open the Virus Activity Dashboard from the Navigator panel. 2. Run a preliminary Virus Activity report to cache necessary services. 3. Set up the replay agent to simulate event flow, focusing on the \virusOutbreak.events file at a rate of 500 events per second. 4. Start the event feed within the real-time agent. For refreshing data: 1. Pause the event feed in the real-time agent. 2. Refresh the display by clicking 'refresh'. 3. Re-select the \virusOutbreak.events file and resume the event feed. In a scenario where there's an unusually high number of virus infections reported, the dashboard will help to: 1. Confirm the issue through visualization tools like red boxes for networks and white boxes indicating virus occurrences. 2. Prioritize actions by highlighting systems with multiple virus events (large white boxes). 3. Assist in making informed decisions about which viruses need immediate containment or cleaning efforts based on their prevalence across hosts and networks. This is a detailed procedure for using ArcSight's dashboard and data monitors to investigate and resolve a virus outbreak. The main steps involve using the dashboard to visually identify the affected areas and systems, then drilling down into specific events to get more details about each issue. The process includes explaining how different parts of the system are affected by viruses based on color-coded indicators (red for targeted network zones, white for viruses affecting users, blue for targeted systems), and comparing these with a moving average to identify spikes like the SQL Slammer Worm. The dashboard allows quick visual assessment of the impact of security events, such as virus outbreaks, which helps in making decisions quickly. It features monitors that display data on different aspects of the situation—for example, the Virus Activity Data Monitor uses color-coding to show affected areas and systems; the Virus Activity Spike-Zone monitor shows where activities exceed a normal moving average, highlighting critical issues like the SQL Slammer Worm. To investigate further, you can drill down from visual summaries into detailed event records by clicking on specific issues. This allows for quicker problem resolution as it provides granular information about each affected system and user. The dashboard also includes an Impact Analysis feature that automatically adjusts priority based on the criticality of the affected asset (e.g., if a mission-critical asset is involved, its priority will be higher). This method leverages ArcSight's capabilities to correlate data effectively across different systems and prioritize actions according to the value of assets at risk. It emphasizes the importance of considering not only immediate virus activity but also the criticality of affected assets when assigning priorities for resolution. This passage discusses the use of a security information and management system (SIM) vendor tool called ArcSight for detecting, investigating, and managing virus outbreaks. The author highlights several key features and benefits of using ArcSight, including its pre-built reports, flexibility in report creation, graphical dashboards, and real-time event monitoring capabilities. The passage begins by mentioning that SIM vendors do not possess the same level of sophistication as ArcSight when it comes to correlation engines, allowing for a more efficient process once an outbreak is detected. The author then proceeds to describe how they have generated a list of affected systems and are ready to initiate remediation efforts in priority order. The passage also discusses the benefits of using ArcSight for detecting and managing insider threats within a corporate network environment. It explains that since the financial institution HKF handles sensitive banking data, it is crucial to monitor activity that could potentially lead to data leakage outside the network. The system can track and alert in real-time about suspicious traffic that may indicate an insider threat, thus helping in preventing potential leaks or breaches of confidential information. The passage concludes by highlighting how ArcSight allows for quick detection, assignment, and investigation of virus outbreaks using graphical dashboards and prioritized events to focus on the most critical issues first. This approach is particularly useful in managing insider threats such as encrypted data transfers to external networks, which are strictly prohibited under corporate policies at ArcNet. The scenario involves monitoring real-time traffic for encrypted data transfers that occur between internal and external systems using an IDS (Intrusion Detection System) like Dragon IDS in conjunction with ArcSight. This setup allows ArcSight to differentiate between internal and external assets, even if the event is low severity due to the nature of the transfer being outside the network. The rule "Insider Threat – Encrypted Data Transfer to External Network" has a severity of 10 based on this differentiation, as it detects potential unauthorized data exfiltration from within the organization. **Event File Information:**

• **External ID:** data2ext:3

• **Event Sources:** Dragon IDS

• **Rules:** Insider Threat – Encrypted Data Transfer to External Network

**Benefits of Using ArcSight:** 1. **Ability to Differentiate Between Internal and External Systems:** By leveraging ArcSight's capability to identify internal versus external zones, it can accurately detect events involving protected assets that are transferring data outside the network. 2. **Enhanced Severity Based on Detection:** Even though the event might be initially classified as low severity due to its origin within the organization, the fact that it involves a transfer to an external system justifies a higher severity rating (10) because of the potential risk and unauthorized access concerns. **Event Demonstration Flow:**

• **Monitoring Centers:** Display the live active channel showing real-time encrypted data transfers.

• **Benefits:** The system allows for immediate detection of such transfers, enabling automatic response actions to be taken in case of unauthorized activity.

• **100% Data Capture:** This is crucial because it ensures comprehensive data monitoring and correlation across all aspects of the security infrastructure, enhancing overall system performance and analysis capabilities.

**Dashboard Presentation:**

• **Unauthorized Traffic Dashboard:** Showcases the types of traffic being monitored, highlighting encrypted data transfers to external networks.

• **Data Monitors:** Describe what each monitor is displaying, such as anomalies or specific patterns indicative of potential security breaches or unauthorized activities involving protected information.

In summary, this setup and demonstration highlight how ArcSight helps in real-time detection of potentially harmful encrypted data transfers from internal systems to external networks, utilizing its ability to differentiate between internal and external assets and adjusting the severity of alerts accordingly. This proactive approach is essential for maintaining robust cybersecurity measures within an organization. The dashboard provides a comprehensive view of outbound traffic, including an alert for unauthorized encrypted data transfer. This feature acts as a monitor with a red light indicating when such activity is detected. Additionally, it offers detailed hourly traffic counts and visualizes events related to unauthorized encrypted data transfer. To access more information or perform further analysis, users can double-click on the event they are interested in. This action will return them to the active channel and provide a workflow with options like viewing additional events of interest, investigating the issue, adding it to a case, launching tools for deeper analysis, etc. Advanced features such as annotation allow real-time collaboration between team members, regardless of their physical location. For example, annotate an event by selecting "initial stage and admin" in the workflow, type your comments, and benefit from seamless communication between less experienced and more senior individuals working together on sensitive matters. This feature enhances efficiency and ensures that critical insights are not lost during remote collaboration. It is crucial to showcase the rule used for detecting unauthorized encrypted data transfer, such as the "Insider Threat – Encrypted Data Transfer to External Network" rule. ArcSight typically comes with several pre-defined rules, which can be utilized directly, adapted into templates, or customized by users based on specific requirements. When examining this particular rule, focus on its description tab that explains its purpose and any additional information you wish to include about the rule for better understanding and context. The provided text discusses a scenario involving a rule in ArcSight for monitoring deleted Active Directory user accounts. Here's a summary of the key points discussed within the text: 1. **Normalization and Categorization**: The system automatically normalizes and categorizes events, making it easier for users to create rules without needing to know all proprietary signatures for different Network Intrusion Detection Systems (NIDS). For example, when creating a rule to detect port scans, users can select the ArcSight category "scan/port" from a dropdown menu. 2. **Actions on Rule Firing**: The text explains how actions can be configured to occur upon the firing of a rule. Options include sending notifications, automatically creating cases in ArcSight or external ticketing systems, executing scripts for blocking traffic (especially encrypted data), and adding sources to active lists. This is particularly useful for monitoring unauthorized data exfiltration attempts. 3. **Case Management**: The text briefly mentions the features of case management within ArcSight, which allows for tracking and managing cases from initial detection through resolution. It emphasizes that by having a list of sources on an active list (for example, those attempting to transmit encrypted data outside the network), subsequent rules can be triggered automatically when needed. 4. **Workflow**: The text outlines the workflow from real-time detection to resolution. This includes the importance of 100% data capture for normalization and categorization purposes, which is crucial for effective incident management and tracking. 5. **Conclusion**: Finally, the conclusion summarizes how ArcSight helps in normalizing information and capturing all relevant data during the entire workflow from real-time detection to resolution. This approach supports efficient case management and compliance with company policies like deleting user accounts post termination. This document outlines a process for auditing user accounts using ArcSight, a software tool primarily designed for security information and event management. The primary objective is to track deleted user accounts and ensure compliance with business policies regarding employee termination. Here's a summarized version of the workflow described in the document: 1. **Preparation**:

• Import a custom report named "DeletedUsers.arp" which contains details about deleted users. This report was created by Aaron Kramer and is used to track user accounts that have been removed from the system.

• Create an Auditor role within ArcSight, using which you will log in through a browser pointing to the specific URL (https://localhost:8443).

2. **Event File**:

• Utilize a demo event file named "Demo.events" that is triggered after certain events in the system (specifically those indexed by ArcSightDemo with IDs 60 and 800).

3. **Rule Execution**:

• The rule "Arcnet Rules/User Profiling/User Profiling-Account Deleted" is activated whenever a user account is deleted, which automatically adds the username of the deleted user to an active list known as the 'Deleted Users Active List'.

4. **Reports and Dashboard**:

• Custom reports like "DeletedUsers.arp" are ready for viewing in ArcSight's special archive section designed specifically for auditors. These reports can be automated and run without direct human intervention, ensuring efficiency.

• The dashboard within ArcSight provides a visual interface to monitor the status of deleted users against pre-defined criteria, aiding in audit processes.

5. **Roles**:

• As an auditor: You will log in using the Auditor role created earlier and review the reports prepared for you in the special archive section. This allows you to see if any user IDs that were supposed to be terminated have been deleted according to business policies.

• As a cyber investigator: Your task is to assist auditors by displaying the original information about users who were deleted as part of an audit, using Windows logs where a User Account (jsmith) deletion event serves as the base trigger for this rule.

This process leverages ArcSight's capabilities to automate and efficiently track user activities, ensuring compliance with organizational policies and aiding in forensic investigations when necessary. The article highlights the value of ArcSight active lists in tracking deleted user IDs, which aids in identifying misuses and abuses such as attempts to use deleted IDs. Without an active list, individual due diligence would be required to remember that an ID was deleted, making it difficult to detect such misuse. Active Lists are valuable for trusted pentesters, hostile IP address tracking, and more. The article also explains the process of adding any username deleted from any operating system to the "Deleted User Accounts" active list using a specific rule in ArcSight (ArcNet/UserProfiling/User Profiling – Account Deleted). This rule captures all deletions regardless of the operating system being used, ensuring comprehensive tracking. Additionally, this method categorizes the event as '/Authentication/Delete' with a successful outcome, facilitating better reporting and monitoring. The scenario described involves using a tool like ArcSight to detect attempts by users to access accounts that have been deleted. This is achieved through an 'Active List' containing the user IDs of deleted users across various systems including Windows, Unix, and Mainframe. The process involves navigating to 'Active Lists', expanding 'ArcNet Active Lists', right-clicking on 'Deleted User Account' to select 'Show Entries'. Once identified, this rule will trigger alerts for both successful and unsuccessful login attempts using a deleted user ID, regardless of the system type (AD, non-AD systems, web servers, Mainframes, Unix, etc.). The purpose of this setup is to alert when: 1. A deleted username is used by an attacker. 2. A deleted username is tried by any user. To implement this rule, a filter for 'AuthVerify' failures and a data monitor for displaying 'Failures to Authenticate' are created. These tools help in monitoring the authentication process and detecting failed login attempts using deleted user IDs. In conclusion, this scenario demonstrates how ArcSight can effectively detect unauthorized access attempts made by users who have had their accounts deleted, providing high-priority alerts based on specific activities or patterns that could indicate insider threats. This setup is versatile enough to be applied across different systems and platforms as mentioned in the demo provided. In this scenario, the user is discussing how ArcSight allows for rapid investigations by providing a unified view of events regardless of their source or syntax. The steps include right-clicking on an IP address to create a filter targeting .11 and viewing all related events in the grid. This method saves time compared to traditional methods where analysts would have to search various sources with different syntaxes. ArcSight reduces data presented by focusing on correlations, which can be visualized quickly using the lightning bolt feature. The example given involves an IBM OS 390 mainframe, demonstrating ArcSight's ability to integrate diverse logs from various sources beyond just firewalls or operating systems. This versatility is facilitated by ArcSight's toolkit that can parse and normalize logs from a wide range of devices and applications not typically supported by other platforms. This text discusses the concept of an "ActiveList" in ArcSight, a feature designed for monitoring interesting events such as deleted user IDs. It highlights how having an ActiveList allows for tracking misuses and abuses like attempts to use deleted IDs, which would otherwise be difficult without this tool. The text also compares ArcSight's capabilities with those of other simple log aggregators by emphasizing its ability to collect data from seemingly innocuous events that can reveal valuable information about attempted misuse of deleted user accounts. The process involves right-clicking on an event in the system, investigating it in detail, and examining specific details like the Destination User Name. In this case, when a user with the name "jsmith" (assumed to be a deleted account) is involved in an attempt to access the system despite being deleted, this information would appear in the ActiveList and could trigger further investigation through ArcSight's capabilities. In summary, the text emphasizes the importance of using tools like ArcSight's ActiveList to detect unusual activities such as attempts to use deleted user IDs, which are crucial for maintaining security by monitoring routine events for potential abuses. In this insider scenario, we have a user attempting to send an email through an external mail server, bypassing the corporate email server and its filters. This action could potentially lead to sensitive data being sent outside the internal network. To address this issue, ArcSight can be used to alert about policy violations that might occur due to such actions. By leveraging ArcSight's capabilities, we can track the source of the violation and investigate the reasons behind the user's behavior. This helps in maintaining security and compliance by ensuring sensitive data is not sent outside the network unnecessarily. This demo outlines a scenario where as a SOC Operator, you are alerted about an internal user attempting to use port 25 of an external non-corporate mail server for sending emails. The purpose is to demonstrate the capabilities of ArcSight in detecting and responding to such incidents. Here's a step-by-step breakdown: 1. Start the demo by logging into your ArcSight console. 2. Open Outlook Express or another email client where you can simulate receiving an alert email related to the incident. 3. Explain the scenario, emphasizing that this is part of a live demonstration outside the main console and focusing on how ArcSight detects unauthorized use of corporate mail servers for sending emails. 4. Switch your view to the email interface (e.g., Outlook Express). 5. Open the received alert email detailing the event where an internal device tried to send SMTP traffic to an external non-corporate server. 6. Explain how ArcSight has automatically sent a notification regarding this critical event to you, including details of the incident detected by the NetScreen firewall. 7. Instruct the audience to click on the provided link in the email that will redirect them to the myArcSight login page within the ArcSight environment. 8. Demonstrate how all components and features of ArcSight are interconnected, providing a unified view of security incidents across various systems and applications managed by ArcSight. This demo showcases the integration capabilities of ArcSight and its ability to monitor network activities such as email communications for potential security threats like data exfiltration or unauthorized access attempts. ArcSight is a system that uses SSL (Secure Sockets Layer) with 128-bit encryption over HTTP to securely connect its components. This includes both consoles and agents connecting to a manager. The myArcSight console provides read access for users, allowing them to view notifications, cases, events, dashboards, among other things. When investigating an event mentioned in an email about "Insider Threat - Mail Sent via External Mail Server," ArcSight normalizes all supported devices' events into a consistent schema, which includes source and target IP addresses along with proprietary intelligence such as category, threat level, and annotations. This normalization helps simplify the interpretation of varied vendor reports on similar attacks. ArcSight differentiates itself by not relying on generic application IDs or event signatures but instead categorizes over 10,000 unique vendor events into a large list of ArcSight categories. This approach ensures that all vendors report the same attack using consistent nomenclature, making it easier for administrators to understand and correlate attack information across heterogeneous devices. To conduct an investigation based on a source IP address (e.g., 10.0.111.28), users can add this address to the "attacker address" column in ArcSight using specific channels, which will then create filters for further analysis. To summarize this information, we're discussing a process using ArcSight for analyzing and visualizing events related to a specific IP address (“10.0.111.28”). The process involves several steps with mouse clicks and leveraging ArcSight features. Here’s the breakdown of each step in detail: 1. **Accessing Events**: Open ArcSight and navigate to the relevant section that shows events related to the specified IP address. 2. **Selecting All Events**: Use a mouse click to select all events related to the IP address using CTRL-A. 3. **Creating an Event Graph**: Right-click in the event grid and select “Event Graph” to visualize attacks associated with the IP address. 4. **Correlated Events Visualization**: Optionally, check the correlated checkbox to filter only the relevant events. This helps in focusing on the specific type of threat you're interested in (e.g., "Insider Threat - Mail Sent via External Mail Server"). 5. **Filtering by Priority**: Set the viewer filter to show “Very High” priority count, which will highlight critical events. 6. **Detailed Chain Analysis**: Right-click on the event of interest and select “RULES OPTION -> Detailed Chain” for a deeper analysis. This can be used either for Q&A sessions or generating detailed reports. 7. **Reports**: Depending on your preference, you can find the event using the demo live grid by looking for events around specific markers (e.g., arcsightDemo:390 and arcsightDemo:1100) or filter to show only correlated rules. **User Friendliness**: The steps provided are designed with user convenience in mind, leveraging simple mouse clicks and interactive features offered by ArcSight. ArcSight is customer-oriented, incorporating many of the features directly requested from its users. This includes right-click steps which help in simplifying complex processes through intuitive actions. Overall, this process aims to be user-friendly, making it easier for users to analyze and visualize events related to specific threats or patterns, providing detailed insights into potential security issues. In this scenario, there's a focus on priority in managing security events using a NetScreen firewall with Arcsight technology. The process involves navigating through an Active Channel window within the Viewer where different colored bars represent varying levels of urgency or importance. By clicking on the red "Very High" bar, only the highest-priority rules are displayed for review. A specific event in the grid indicates a priority 10 correlated rule alerting about mail sent via external mail servers, which is critical due to potential confidential information exposure through corporate email servers' filters. The incident involves an unauthorized use of port 25 for SNMP mail service, default setting for forwarding emails, which was detected and reported by the NetScreen firewall. To address this issue, a customized rule in Arcsight has been configured to trigger when such actions occur, ensuring that all outbound emails are sent through corporate mail servers only. This is achieved by checking if the target host is outside known Arcnet assets and involves port 25 usage. The rule includes conditions about the attacking host being an Arcnet asset, port 25 utilization, and successful firewall report of the action. To investigate this event further, Arcsight's Case Management functionality can be utilized by creating a case, assigning it to a Security Analyst team member for detailed investigation. This process starts with highlighting the specific event in the grid, right-clicking on it, and selecting "Add to Case." The case management interface then allows for further analysis and action based on findings from this rule. The provided text outlines the setup and execution of a case management system for detecting potential malicious behavior originating from internal dark address space, as identified by ArcSight rules. Here's a summary of the key points and benefits: **Setup:** 1. **Identification of Dark Addresses:** Internal addresses are flagged as "dark addresses," where no traffic should originate or terminate. An ArcSight rule detects traffic on these addresses, suggesting possible malicious activity. 2. **Creation of Active List:** A new active list named "Dark Address Space Sources" is created under /Active Lists/Shared/All Active Lists/ArcNet Active Lists. This list captures attacker addresses from events. 3. **Editing the Rule:** The rule "Insider Threat – Traffic From Internal Dark Address Space" is edited:

• Set priority action to 8.

• Add two actions: one to add the attacker address to the active list and another to create a case.

• Use the created active list, include the event field "Attacker Address," and trigger on the first event.

4. **Case Creation:** A new case named "Traffic from Dark Address Space" is created under "/Cases/Shared/All Cases." It is assigned to the user group Network Admins with the administrator as the owner. 5. **User Group and User Setup:** Create a user group "Network Admins" and add the user smithj within this group. **Benefits of Case Management System:**

• **Proactive Detection:** The system proactively alerts to policy violations that may indicate malicious behavior, enhancing security measures.

• **Efficient Incident Handling:** By organizing incidents into cases with predefined fields (like case name, owner), the system facilitates better tracking and management of potential threats.

• **Scalability:** The ability to create user groups and assign permissions ensures scalability as more users are added or roles change within the organization.

**Preparation Before Demo:**

• Ensure that active lists and rules are set up correctly to trigger events promptly during the demonstration.

**Demo Execution:**

• Launch demo events at least 5 minutes before the scenario, generating at least 100 events per minute to capture the first event indicating malicious activity from dark address space.

This case management system efficiently handles potential security incidents and ensures that they are addressed promptly and effectively by assigning them to specific analysts for further investigation. As a security analyst, I begin by logging into MyArcSight, where I have access to all open cases related to enterprise security events. Within this system, I can efficiently review and manage various security incidents through a user-friendly interface. To start with, I navigate to the "MyCases" section, which aggregates all open cases generated automatically through correlation rules set up for different scenarios, including unauthorized use of private IP addresses (RFC 1918 or dark address space). I then locate the specific case named "Traffic from Internal Dark Space." This case was likely triggered by an event originating from a network segment that is not part of the officially assigned RFC 1918 private IP range. By clicking on this case, I can gain more detailed insights into the incident. Upon examining the initial tab of this case in "MyArcSight," I focus on several key items: 1. **Description**: The automated creation of the case typically includes a description that outlines why the case was opened and what triggered it. This helps in understanding the nature of the security breach or potential vulnerability, such as unauthorized access to private IP space. It also provides context for any necessary remediation actions. 2. **Owner**: Cases can be reassigned to other ArcSight users who are better suited to handle the investigation and resolution. For instance, a network administrator might be assigned this case if they are responsible for maintaining the integrity of the enterprise network. This reassignment helps in efficiently utilizing specialized expertise where needed. Additionally, under the "Events" tab, I can click on the name of the event that initiated the rule. This will display detailed information about the specific security incident detected by ArcSight ESM (Enterprise Security Manager), including details like source IP address, timestamp, and potentially any associated log files or network traffic data. By systematically reviewing such cases in MyArcSight, analysts can rapidly assess the enterprise's overall cybersecurity posture and respond appropriately to incidents involving unauthorized use of dark address space. This approach not only aids security analysts but also helps network administrators ensure that the necessary preventive measures are in place to safeguard the organization's private IP assets. To summarize, when using MyArcSight to review a security case triggered by an automated rule from a Netscreen Firewall incident that involved data being accepted into a Hong Kong financial network space asset range (hkfinancial.cn – Dark Address Space), the following steps are taken: 1. **Review Raw Events**: The operator can access raw events associated with the triggering rule, which in this case is an acceptance event from a Netscreen Firewall. By scrolling through the raw event details under the device section, it's noted that the trigger was indeed an accept from the firewall. 2. **Remediation**: As a security analyst, part of the remediation would involve adding a new firewall rule to block all future traffic originating from this network space to prevent further incidents. 3. **Case Management in MyArcSight**: After making changes through MyArcSight, such as updating the case description and assigning it to a network administrator (smithj), that individual will be able to view the same detailed event information through their MyArcSight interface. 4. **Transition to ArcSight Console**: To understand how the rule was triggered and the case created:

• Navigate to the ArcSight Console where assets can be profiled by IP Address or address ranges, as seen with the hkfinancial.cn – Dark Address Space asset range.

• Through categorization (Categories tab under Asset Range Editor), business context is applied to these assets and ranges based on location and network significance.

• In the rules section, expand to find the specific rule that was triggered for the case creation.

This process demonstrates how ArcSight can profile networks, identify raw events triggering security rules, manage cases through its interface, and categorize asset ranges based on contextual information. The Insider Threat rule in ArcSight ESM is designed to detect suspicious activities originating from internal users or assets within an organization's network, specifically targeting unauthorized access to sensitive data through dark address spaces. Here’s a breakdown of how this functionality works step-by-step and what each part of the process entails: 1. **Conditions Tab**: In the Inspect/Edit window, navigate to the Conditions tab where you configure the rule logic. You need to select 'Assets' in the rule logic section and set conditions such that the source asset id falls into the Internal Dark Address Space category. This setup is crucial for pinpointing events within unauthorized spaces potentially used by insiders for malicious activities. 2. **Aggregation Tab**: When you switch to the Aggregation tab, you configure how often the system should check for new events or updates related to the conditions set in the previous step. In this case, since we are looking for a single event that triggers the rule (rather than multiple occurrences), it ensures quick response to any initial breach indication. 3. **Actions Tab**: Here, you define what actions should be taken upon detecting an event that matches the condition of being sourced from an internal dark address space. You perform five specific actions:

• Sending all detected events to the console for visibility.

• Setting a high priority (8) for the alert, ensuring it gets immediate attention.

• Assigning the device group to facilitate correlation and tracking related events.

• Adding the attacker’s address to the Dark Address Space Sources active list for future monitoring.

• Automatically creating a case within MyArcSight to notify security analysts about the detected threat.

4. **Active Lists**: In the Navigator Window, go to Active Lists where you expand /Active Lists/Shared/All Active Lists/ArcNet Active Lists and right-click on Dark Address Space Sources to view entries. This active list can be used for building more advanced rules as mentioned: You could create another rule that boosts the priority to 10 and sends an immediate alert to the security team if a similar event is detected from an address in this list targeting assets categorized as SOX or HIPAA compliant systems. **Conclusion**: Through asset profiling, rule actions, and automated case generation, ArcSight ESM enables swift detection of potential insider threats by identifying unauthorized use of dark address spaces within the network. This setup not only helps in alerting security analysts about critical threats but also automates response processes to ensure a robust defense mechanism against such internal risks. ArcSight is a powerful tool used for monitoring network activities, particularly in security operations centers (SOCs). It can be leveraged by other groups such as network administrators for investigation and remediation of events that may indicate malicious behavior. In this scenario, ArcSight raises a high priority alert due to repeated failed FTP attempts to multiple untrusted servers, which could suggest potential insider threats or unauthorized data access. ArcSight's ability to detect policy violations can be beneficial in identifying suspicious activities that might otherwise go unnoticed. When the system detects such events, it triggers an alert based on predefined rules and generates a case automatically within the Case Management System (CMS). This allows administrators to focus their efforts on specific incidents for investigation and further action. To utilize ArcSight effectively in this scenario: 1. Log into the ArcSight console and navigate to the "Reply Tab" at the agent level, where you can view events such as demo.events. Adjust the number of events displayed based on your requirements (typically set between 270-300 events per minute). 2. Monitor the system for the appearance of arcsightDemo:550 and adjust the rate to focus on repeated FTP attempts, setting a maximum rate of 2 to concentrate on these specific alerts. 3. Access the Grid in the ArcSight console and select High priority events from the top right-hand area. Apply the "Insider Threat – Reported FTP Attempts to Untrusted Servers" rule to view detailed chain reports that include NetScreen Logs Firewall Logs before the rule is triggered. 4. In the CMS, locate and expand the case related to the detected incident using the navigator windows. Review the reason behind the rule triggering by accessing the relevant rules and policy settings within the shared folder of the Insider Threat module. By following these steps and leveraging ArcSight's capabilities for detailed event analysis and automated case creation, network administrators can efficiently investigate potential security breaches or unauthorized activities and take appropriate action to protect their organization's data and infrastructure. The scenario involves a user account being deleted and subsequently, a failed login attempt using that same deleted account. This situation raises suspicion of a terminated employee attempting to access corporate systems. ArcSight detects this via alerts and can be used to monitor critical assets for potential malicious behavior. The dashboard provides visualizations such as real-time event graphs, group counts, top attackers targeting critical assets, events originating from or targeting specific assets, and anomalies in target ports. The geographic view shows the source and target locations of these events geographically. Additionally, there's a visualization of attacks on critical assets with their corresponding ArcSight priority statuses. The scenario also mentions brute force failed login attempts to a Windows server, which could be part of the malicious activity being monitored by ArcSight. The dashboard helps in understanding the nature and severity of potential threats to the organization's critical systems. The text describes using ArcSight's Pattern Discovery Engine to detect repetitive or multiple attack patterns. By navigating through profiles, expanding ArcNet settings, and right-clicking on specific behaviors, a snapshot is taken of detected patterns. These patterns can be inspected for details like transaction counts between sources and targets. To ensure future detection of similar behavior, rules based on the discovered pattern can be created with conditions specifying different event names and occurrences within a short time frame. The scenario described involves a brute force login attempt against a mail server followed by successful login and subsequent behavior targeting a DNS server using OS logs captured through Unix Syslog. Here's a summary of the key points: 1. **Initial Brute Force Attempt**: An attacker launches multiple failed login attempts to the mail server. These are detected as brute force logins in the ArcSight system, triggering alerts based on predefined rules. 2. **Successful Login**: Despite numerous failures, the attacker eventually logs into the mail server successfully. This event is identified by the rule set for probable successful attacks through brute force and triggers a compromise alert. 3. **Subsequent Behavior**: Following the successful login to the mail server, there's evidence of abnormal behavior originating from the compromised mail server targeting the DNS server. This pattern suggests continued malicious activity. 4. **Compromised Systems Identification**: The mail server and the DNS server are added to a "compromised" active list in ArcSight, which is displayed on the compromised systems dashboard. This helps in monitoring and managing high-priority alerts related to potential security breaches. 5. **Benefits**: By using OS logs and leveraging ArcSight's capabilities, the organization can promptly identify and respond to possible system compromises, enhancing overall security posture. 6. **Demo Workflow Details**: The scenario is introduced with a presentation to the Chief Security Officer (CSO) about how ArcSight can assist in immediate security breach response. The demonstration showcases the integration of OS logs from Unix Syslog into the ArcSight system and the subsequent alerting mechanism based on predefined rules, which highlight potential compromised systems. 7. **Event Details**: The events linked to this scenario are numbered 340, 350, and 1050 in part, with occurrences at times indicated by commas (e.g., 340, 350 and 1050, 1060). These events involve Unix Syslog as the source, indicating the nature of data captured during the demo scenario. 8. **Rule Application**: Specific rules such as "Application Brute Force Logins" and "Probable Successful Attack - Brute Force" are applied to detect patterns related to unauthorized access attempts and successful breaching actions. These rules help in identifying potential security breaches more effectively. 9. **Reporting and Dashboard**: The scenario results in alerts that can be visualized through reports and displayed on the compromised systems dashboard, providing a heads-up and port anomaly display to monitor potential threats dynamically. This summary highlights how ArcSight leverages system logs for proactive threat detection and response, particularly focusing on brute force attacks and successful breaches which are critical indicators of potential security compromises. As a network engineer for Enterprise ABC, you discover that both your DNS and Email servers are compromised. When you log into the ArcSight Console, you first check the status on the Dashboard. You notice anomalies indicating potential issues with mail01 (Email) and bind01 (DNS). Clicking through to each server reveals specific attacks:

• 10.0.111.5 (Email) is being attacked by 10.0.111.6 (DNS), suggesting a possible DNS hijacking or abuse.

• An unknown IP address, possibly a hacker attempting to exploit the system, is attacking 10.0.111.5 (Email).

To investigate further: 1. Use inline filters to set parameters for activities on IPs 10.0.111.6 and 10.0.111.5, or use the Investigate function to focus on the event where an attacker IP is 10.0.111.5. 2. Review specific rules: Application Brute Force Loggins (after oslogging:6) and Probable Successful attack Brute Force (after oslogging:11), as well as those with higher indices up to 23, which indicate a pattern of failed and successful brute force login attempts. 3. Expand the details of each event to understand the progression of the attacks, noting that these rules adapt dynamically based on event occurrences, providing real-time insights into potential security breaches. This strategic investigation helps in identifying the sequence of events, from initial failed attempts (as per Application Brute Force Loggins) to successful exploitation (as per Probable Successful attack Brute Force), using pre-defined rule sets that are adjusted based on log data and event details captured by ArcSight's system. The provided text discusses two scenarios involving security incidents in an organizational environment, both of which are monitored and reported using ArcSight software. **Scenario 1: Authentication Failures and Successes on a Mail Server** This scenario involves monitoring authentication events on a mail server where there is a pattern of attempting to authenticate with rules looking for /authentication/verify /failure followed by an event categorized as /authentication/verify /success. These rules are not vendor-specific, indicating they could potentially be applicable across various systems or applications. After successful login, the same behavior is observed targeting a DNS server, suggesting potential exploitation attempts from compromised accounts. Both systems involved in these authentication and verification processes have been added to the compromised active list and should appear on the compromised systems dashboard. **Scenario 2: USB Policy Violation** This scenario involves monitoring violations of a company's USB storage device policy using Windows logs. It specifically notes two types of violations: inserting a USB device (which is against policy) and inserting a CD-ROM storage device into a confidential data asset, also against policy. The ArcSight system immediately notifies security analysts in real-time about any detected policy violations. Relevant rules are triggered from P2P traffic that is disallowed within the company's network environment (ArcNet). Violations result in notifications to be reviewed through specific reports and tracking devices on the active list, which tracks IP addresses of violators. **Preparation for Scenario 2:** To ensure effective monitoring under this scenario, it was recommended to create new users with specific roles:

• **ISO User**: This user should be part of the Analyst Group as a Normal User and has been assigned an ISO title indicating management level access.

• **CERT User**: This user is also in the Analyst Group but is designated as a Normal User without elevated privileges, representing daily operational use within ArcSight.

These steps are outlined to facilitate real-time monitoring of USB storage device violations according to established security policies. This document outlines a scenario demonstrating how ArcSight can detect unauthorized USB storage devices connected to confidential data assets within an enterprise environment. The scenario involves two users with different roles, CERT (an analyst) and ISO (Information Security Officer), who use their respective consoles to address the challenge of managing internal threats from employees, contractors, or trusted users potentially stealing confidential data through the use of personal USB storage devices, external CD ROMs, etc. **Exhibit 2**: Describes how to create a new escalation level and destination within ArcSight. The process involves editing an existing rule ("Policy - USB Storage Device Attached to Confidential Data Asset") by adding actions such as "Send to Notifier" and selecting the appropriate management under Level 1, followed by including the event field "Attacker Address". **Exhibit 3**: Outlines steps to create a new destination within ArcSight. This involves setting up rules for notifications when USB storage devices are detected attached to confidential data assets. **Exhibit 4**: Shows how to edit an existing rule ("Policy - USB Storage Device Attached to Confidential Data Asset") in the ArcSight Console, adding actions like "Add to Active List" and selecting the policy violator as the action recipient. This rule triggers upon detecting the first event of a USB storage device being connected to a confidential data asset. **Exhibit 4.1**: Changes the privileges on the ArcNet Reports group by editing access control list (ACL) settings in the Navigator Panel for reports, allowing all users to have full access. **Just prior to demo**: It is recommended to pre-populate the Policy.events with at least 5 minutes of data at a rate of 100 events per minute before initiating the demonstration scenario to ensure timely receipt of the first event. The purpose of this scenario is to showcase how ArcSight can be used to monitor and alert enterprises about unauthorized USB storage devices connected to confidential data, highlighting how analysts (CERT) and managers (ISO) within an enterprise can leverage ArcSight for security management tasks based on their specific roles. The process involves logging into the ArcSight Console as a CERT user, which restricts full admin privileges. Begin with examining the Live Active Channel, where all events being correlated in real-time are displayed on a grid. If necessary, review the options available in the Grid view to better understand and manage the displayed data. To proceed: 1. Select the "Grid" option from the interface to view all current events being processed by ArcSight for correlation. 2. Choose the "Live Active Channel" to see a real-time display of all correlated events. 3. Check the lightning bolt icon in the grid to filter only the correlated events. 4. Locate the specific event named "USB Storage Device Attached to Confidential Data Asset." This can be found as per Exhibit 5, which should be referenced for clarity. 5. Explain that while this interface is similar to a standard event grid, it focuses on the activities ArcSight has correlated and highlights the importance of rule-based correlation in cybersecurity management. 6. Perform a right-click operation and select "Rule Options - Show Detailed Chain" (refer to Exhibit 6). This detailed view will show both base events and their correlations, displaying information such as time sequence, event name, address, and priority (Exhibit 7). 7. Highlight that ArcSight has increased the original Windows-provided priority from a 4 to an 8 for this rule. 8. Double-click on the Windows base event in the detailed view to open the Inspect Window (Exhibit 8), where users can explore the schema and fields collected by the sensor, with specific attention to any field containing "USB" in its name. 9. Explain the functions of Impact Analysis and Payload Tabs as well as Field Set and Hide Empty Rows options within this interface. 10. Right-click again and select "Rule Options - Show Triggering Resource," which leads into the rules editor, where users can enter to review conditions (Exhibit 6). 11. Navigate to the Conditions Tab in the rule editor to find ArcSight's Boolean Logic Editor, discussing how it uses basic tabs and schema to set conditions for rules (Exhibit 9). 12. Emphasize the use of asset categories within rules and demonstrate how changing "Contains usb" can edit the rule conditions dynamically. The summary should focus on explaining how ArcSight's bundled rules can be edited for specific conditions, such as changing "usb" to "cdrom," which allows for more targeted alerts. It also highlights the aggregation parameters that trigger a single event rule in ArcSight. Additionally, it discusses the actions taken by default and how they are customized for ISO users, including sending events to the console, defining significance and technique, notifying management groups, and adding IP addresses to active lists. Finally, it explains the process of creating new cases or moving on from issues after CERT user involvement. The summary should be clear and informative, suitable for a non-technical audience. The article outlines a process for identifying and managing potential insider threats using CRM or HR events from systems like SAP or Salesforce.com, which are integrated with ArcSight for real-time monitoring. The data is compiled into a spreadsheet containing three key pieces of information (Type of event, username, and data) and sent to ArcSight where it is processed to populate watch lists for terminated employees and suspicious users. Rules then automatically add usernames from these events to the active list of suspicious user accounts, which can be accessed through reports. These reports help in monitoring activities involving suspicious user accounts and hosts accessed by such users, providing a proactive approach to insider threat management. The benefits include a quick and automated view of potential threats within an organization. The dashboard provides a user profiling system that tracks user activity in real-time, with spikes indicating potential suspicious behavior prompting the addition of users to a "suspicious user watch list." This feature is designed to monitor terminated employees and other individuals who might attempt unauthorized access using former employee accounts. By analyzing this data through various monitoring centers, such as ArcSight, benefits include the ability to detect encrypted data transfers that may bypass security measures, providing real-time action on potential breaches. The dashboard demonstrates a demo live active channel for visual presentation and explanation of normalization processes in cybersecurity event management. This involves using proprietary signatures across multiple sources to identify events more accurately (BENEFIT 1). The user profiling dashboard displays detailed information about employees who have been terminated, placed under administrative leave, or whose accounts were attempted to be accessed by former employees. It uses last state monitors that change color based on the severity of alerts (such as green for no issues, yellow for warnings, and red for critical situations) to quickly assess risk levels. The dashboard provides insights into access attempts from terminated employee accounts, enhancing security measures against potential data breaches. This system ensures comprehensive monitoring and response capabilities in real-time, vital for maintaining secure information handling within an organization. The passage describes a comprehensive solution for security and workflow management within an organization, particularly focusing on real-time collaboration and reporting capabilities using software like ArcSight. It begins by detailing how users can interact with a dashboard, including drilldowns, workflows, annotation features, case management, and report generation. For instance, the user interface allows for detailed exploration of events through interactive dashboards that facilitate workflow navigation. Users can right-click on specific rows to filter or investigate further, annotate important events for collaboration, manage cases related to detected threats, and access a variety of reports tailored for different compliance scenarios, such as attacks against compliant systems like Sarbanes Oxley (SOX) regulations in financial databases. The software supports real-time collaboration between team members through annotation tools, ena,bling remote workers or those located far apart to work on the same event simultaneously without physical proximity. This is particularly useful for less experienced personnel who can learn and contribute from more seasoned colleagues. Additionally, ArcSight provides a suite of reports that users can run based on specific templates or create themselves, such as tracking suspicious user accounts accessing sensitive hosts. These tools help in understanding potential threats and managing compliance with regulations like Sarbanes Oxley by prioritizing alerts according to the nature of the affected asset. The conclusion emphasizes how this integrated system makes complex security operations easy to understand and manage effectively. It also highlights a compliance scenario, where an attack on a compliant financial database is correlated across multiple devices using ArcSight’s correlation engine, which automatically adjusts priorities based on SOX regulations. This setup not only helps in detecting threats more efficiently but also supports legal and regulatory compliance by providing detailed reports and traceable actions for forensic investigations. This scenario demonstrates ArcSight's advanced capabilities in correlating data from various sources to detect and respond to threats effectively. Here's a summary of the key points along with recommended actions: 1. **Event Details**: The demo involves an event triggered by Arcsight, using vulnerability scanner data and asset information. This setup is crucial for identifying potential security risks against SOX-compliant systems. 2. **Data Collection and Analysis**: ArcSight collects comprehensive data about the event, including details about the target asset named 'trans01'. This approach ensures that no relevant information is overlooked during the analysis process, enhancing the accuracy of threat detection. 3. **Business Impact Assessment**: By examining the Business Impact Analysis tab in the Event Inspector, users can gain insights into how specific systems (like trans01) are impacted by Sarbanes-Oxley compliance and other critical factors such as revenue generation and storage of customer data. This helps in understanding the potential risks more clearly. 4. **3D Correlation Capabilities**: The demo highlights ArcSight's 3D correlation, which allows for better visualization and analysis of correlated data across multiple dimensions (e.g., compliance requirements, asset importance). This feature is crucial for proactive security management against threats like SOX compliance violations. 5. **Dashboard Usage**: Instead of manually searching through active grids, ArcSight offers a pre-built Compliance Dashboard that facilitates real-time monitoring and drill-down capabilities to track events related to compliant systems efficiently. **Action Steps**:

• **Event Inspection**: Double click on the Attack Targeting SOX Compliant System event in the grid to explore details using the Event Inspector. Review all available fields to understand the full scope of the data collected.

• **Data Collection Insight**: Consider how collecting 100% of the data can benefit security measures by providing a comprehensive view that helps in making informed decisions about system compliance and potential threats.

• **Business Impact Evaluation**: Use the Business Impact Analysis tab to assess specific impacts on systems like 'trans01' related to Sarbanes-Oxley and other critical factors. This will help correlate with 3D correlation capabilities introduced in the product presentation.

• **Dashboard Monitoring**: Utilize the Compliance Dashboard to monitor events against compliant systems, providing a strategic overview for ongoing security management without manual intervention.

Overall, this scenario showcases ArcSight's ability to integrate data from disparate sources and provide actionable insights through advanced analytics, crucial for addressing compliance requirements and enhancing overall security posture. This dashboard provides detailed information about your compliant assets, allowing you to monitor various data points related to compliance regulations. Here's a summary of the key features and their talking points: 1. **Compliance Requirements Categorization**: Arcsight helps in categorizing assets according to compliance requirements such as Sarbanes-Oxley (SOX) and Health Insurance Portability and Accountability Act (HIPAA). This is crucial for financial companies like HKFinancial that handle regulated data, ensuring all assets are categorized correctly. 2. **Asset Assignment**: In the Navigator panel, clicking on "Assets" and then "Site Asset Categories/Compliance Requirements" allows you to assign assets to specific categories based on compliance requirements. For example, Sarbanes-Oxley compliance can be viewed by right-clicking on it in the asset tree. 3. **Integration Guides**: ArcSight offers comprehensive integration guides for using the system with regulated systems, ensuring seamless compliance management. 4. **Reporting and Analytics**: The dashboard includes reports that focus on compliant systems, such as those subject to Sarbanes-Oxley or HIPAA compliance. Running reports like "Vulnerabilities found on Sarbanes Oxley Compliant Systems" and "Attacks targeting SOX compliant Systems" provides detailed insights into the compliance status of your assets. 5. **Wow Factor**: The Attacks per Compliance Group can be displayed as a pie chart, showcasing the distribution of attacks across different compliance groups, adding an engaging visual element to your presentation. These features and talking points help demonstrate how ArcSight supports regulatory compliance by providing detailed information, actionable insights, and robust reporting capabilities for both Sarbanes-Oxley and HIPAA compliant systems. In this scenario, Chadd Milton, as the SE Owner, observed an attempt to access the HR webserver from a system not authorized for such access. The action indicated that the unauthorized system was attacking the HR web server, which is regulated by HIPAA due to its role in managing employee health care data. As the attack progressed, it also targeted the HR database. This progression serves as concrete evidence of the compromised state of the HR webserver and triggered a specific rule within ArcSight related to Compromised Asset Attacking Internal Systems. The use of ArcSight in this situation allows for prioritization based on HIPAA compliance regulations, ensuring that sensitive information is protected with high priority. It also demonstrates the effectiveness of ArcSight's 3-D correlation capabilities against asset data, enabling efficient detection and response to security threats. Furthermore, ArcSight provides detailed reports such as "Compliant Systems – By Attack" and "Count Vulnerabilities," which help in understanding and managing compliance with HIPAA regulations. The demo setup involves setting up a scenario where an unauthorized system tries to access HR data, which is protected by HIPAA regulations. The demonstration also includes the use of ArcSight for real-time monitoring and reporting capabilities. This setup prepares users for engaging with the ArcSight console and Adobe Acrobat software to review archived reports related to cybersecurity events. In summary, this scenario showcases how a healthcare enterprise can leverage cybersecurity tools like ArcSight to comply with HIPAA regulations while protecting sensitive employee health information from unauthorized access attempts. In this scenario, I am acting as a security engineer for ArcNet, responsible for the Eastern region. The demonstration will showcase how rcSight ESM can categorize assets to apply business intelligence to events targeting or sourcing from these systems using network diagrams and real-time dashboards. First, we'll briefly explain that due to ArcNet’s organizational structure with geographical responsibilities, network diagrams serve as an overlay for each region, alongside real-time dashboards displaying events in near real time. Next, I will double click on the Pie Chart in the top right corner of the East region. This action allows us to nest network diagrams and use them for drill down purposes to understand the context of occurring events more granularly. This is crucial for hierarchically organizing enterprise security events and presenting them with additional intelligence about their location and potential impact. Then, I will double click on the Horizontal Bar Graph at the bottom of the window, just right of HRDB01. This step shows all events targeting the HR network in the Eastern Region. After that, I'll click on the lightning bolt box to display only correlated events. Using the CTRL Key, I select two specific events: "Attack Targeting HIPAA Compliant System" with source IP 10.0.113.187 and "Compromised asset attacking Internal Systems". Right-clicking on these events and selecting "Show Event Details", I open the event inspector window to view detailed information about each event. Here, we expand both rule chains and highlight all related events using the Shift Key. Right-clicking over the highlighted events and choosing "Event Graph" provides a visual representation in the Event Graph active channel. Finally, in this step, I will explain how the system represented by the blue line is both a target and an attacker source in this situation. This explanation highlights the complex interactions between systems as identified through the event analysis within the Eastern Region's network. To explain how event graphs are useful for understanding the life and impacts of an event, let's break down the process step-by-step: 1. **Event Graph Overview**: Event graphs provide a pictorial representation that helps in quickly interpreting and understanding the sequence and effects of an event. Since pictures can convey more information than words, they are valuable for this purpose. 2. **Investigating with ArcSight ESM**: When investigating events using ArcSight ESM (Enterprise Security Manager), you should ask specific questions to gather more information:

• How did we know in the first highlighted event that the target address was a HIPAA compliant system? This can be answered by mentioning the capability of ArcSight ESM to profile assets, which indicated that the asset identified as the target was originally categorized as being HIPAA compliant.

3. **Using Event Inspector Window**:

• Select the first event in the chain and scroll down to find the Target Asset ID field. Double-clicking this field opens the asset editor where specific attributes of the asset can be viewed, including its category.

• Under the Asset Editor tab, click on Categories to see that the asset is indeed categorized as HIPAA compliant. This confirms the system's compliance status based on categorization.

4. **Correlated Events**:

• In the event inspector window, select a correlated event (e.g., WEB-ISS MDAC…) within the Compromised Asset Attacking Internal Systems chain. Double-click Target Asset ID to open the asset editor and check categories again.

• The customer should understand that while the initial target was HIPAA compliant, the priority of the correlated event is set high (priority 10) due to a compromised host detected from a previous attack, specifically the HR Web server. This demonstrates how multiple factors can influence the severity of an event and why certain assets are prioritized for further investigation.

5. **Auditor Use**: Explain that auditors can also use ArcSight reporting to satisfy HIPAA's "due diligence" requirements by reviewing archived reports. Navigate to the Reports section, find ArcNet Archived Reports, and execute a search as instructed to view detailed report outputs. By following these steps and explaining each detail in a clear manner, you help stakeholders visualize how event graphs are utilized for incident analysis and compliance auditing within the HIPAA framework. This document explains how using ArcSight Enterprise Security Manager (ESM) with vulnerability data from tools like Nessus can help organizations comply with HIPAA regulations and satisfy auditors' due diligence requirements. The report "iance Systems – By Attack – Delta.pdf" is used to demonstrate how regular vulnerability scans, imported into ArcSight ESM, can identify critical assets with newly identified vulnerabilities and alert security personnel to potential risks before they become security events. ArcSight ESM's capabilities include: 1. **Scheduling Reports**: The report "Compliant Systems – Count Vulnerabilities.pdf" can be scheduled to show auditors and executives the efforts required in reducing the number of events impacting compliant systems over time. This helps in demonstrating compliance with HIPAA regulations by highlighting vulnerabilities that need attention. 2. **Immediate Reporting on Critical Assets**: By importing regular vulnerability scans, ArcSight ESM can immediately report on critical assets affected by newly identified vulnerabilities. This functionality allows for early alerting to potential threats, helping auditors and security personnel respond quickly to risks before they escalate into serious security incidents. 3. **Compliance Through Historical Data**: The system also provides historical reporting based on vulnerability data, which assists in satisfying the due diligence regulatory requirements of HIPAA and other acts. This helps auditors and executives prove corporate compliance by showing continuous improvement in risk management. 4. **Asset Creation and Management**: Assets can be created manually or via scanner agents that take data from vulnerability scanners. These assets are used to identify vulnerabilities and open ports on specific systems, providing a comprehensive view of the security posture of critical infrastructure. This process is intensive but valuable for maintaining up-to-date information about potential risks. 5. **Vulnerability Scanning**: Nessus Agent can be set up to run checks on selected assets, sending reports directly to ArcSight ESM. These scans are not mandatory and can be scheduled either in the background or interactively, providing flexibility while ensuring regular updates of asset vulnerabilities. 6. **Event Correlation**: The vulnerability data is used by ArcSight ESM's 3-D correlation capabilities to quickly respond to threats attacking critical and regulatory compliant assets. This helps in real-time threat detection and management, enhancing the overall security posture of the organization. In conclusion, through the integration of vulnerability data with ArcSight ESM's advanced analytics and reporting features, organizations can effectively manage compliance with HIPAA and other regulatory standards, satisfy auditors’ requirements for due diligence, and demonstrate continuous improvement in corporate risk management. The text provides a description of using ArcSight, a security information and event management (SIEM) tool, to manage and monitor assets within an organization. Here's a summary of the process described in the text: 1. **Asset Management:**

• The user is instructed to navigate through the DAC (demo active channel) grid to view auto-generated asset information under "/All Assets/ArcNet Assets."

• A Scanner Report for "oradb01" from ArcNet Assets is requested.

• Detailed assets are described using various categories such as operating system, patch levels, and applications by expanding the Asset Cat tab to include "/All Asset Categories/Site Asset Categories."

• The user can assign importance to these assets through Asset Criticality Categories based on their vulnerability, open port information, and historical context of attacks.

2. **Vulnerability Management:**

• A severe vulnerability was detected on the system hkfinancial which holds regulated data.

• Automatically generated a case for investigation regarding vulnerabilities found on this system that should not have severe vulnerabilities.

• Navigate to Cases > Show Public Cases/Non Compliant System Severe Vulnerabilities Found to view and manage the case.

• The user can track progress and investigate related events using the case management feature of ArcSight.

3. **Workflow and Collaboration:**

• Select specific events (2.5rule:0-78) that occur after certain ArcSightDemo events (10 and 700).

• This involves setting up a workflow to efficiently manage SIEM tool interactions and collaboration between users in the organization.

Overall, the text outlines how an organization can leverage ArcSight to systematically assess asset vulnerabilities, generate cases for remediation based on detected issues, and maintain transparency and accountability through automated workflows. The provided text describes an operational process used in handling events within a system, likely related to cybersecurity or similar fields. Here's a summarized breakdown of the scenario and its key points: 1. **Event Management Process**:

• Users can annotate events by setting them to an initial stage and assigning them to administrators.

• Throughout the day, users might add new events as they are assigned or self-assigned. These events will appear in a designated channel called "My Open Events Channel."

• The system allows for easy management of these events across various stages depending on their urgency or type.

2. **Operational Framework**:

• Operators can see and interact with events, potentially escalating issues to higher-level analysts if necessary.

• It's emphasized that the data remains unchanged (unchanged data is crucial for legal reasons), and annotations are just references to event IDs stored in a side table of the database.

3. **ArcSight Discovery**:

• This feature uses advanced data mining techniques to identify potential security concerns by detecting repeated behavioral patterns across events.

• The system helps in flipping from rule-based handling to real-time monitoring, which is crucial for addressing unknown threats and vulnerabilities that emerge daily.

• Users can configure the "Discovery Profile" with specific parameters such as minimum pattern length and occurrences to tailor detection to known or suspected threat types (like worms, vulnerabilities).

4. **Execution of Discovery**:

• After setting up a profile, users run it to identify repeated behaviors that might indicate potential security issues.

In summary, the text outlines an operational framework for handling events in a cybersecurity environment, including annotation and classification processes, using advanced tools like ArcSight Discovery to detect emerging threats effectively. The process involves running a profile that includes demo.events and examining the workflow visually represented by a tree structure. By navigating the tree, one can observe various behaviors and identify recurring patterns within the data or processes being analyzed. Once specific patterns are identified, they should be assigned to an individual responsible for further investigation and development of associated rules. The ultimate goal is to establish a baseline that will serve as a foundation for future reference and decision-making in similar situations.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.