HP ArcSight - Default Content - All Resources - RepSM v1.5_1

Summary:

The document you've provided outlines a comprehensive report from the Trend Micro Reputation Security Monitor 1.5, which is designed to detect and respond to various cyber threats such as infected assets, malicious entities, zero-day attacks, dangerous browsing activities, and more. Here’s a summary of what this report covers: ### Queries: 1. **Internal Infected Assets/Currently Infected Assets and Recorded Interactions with Malicious Entities**: This query provides a list of currently infected assets along with their interactions with malicious entities. It helps in identifying which internal assets have been compromised or interacted with harmful elements online. 2. **Infected Asset Count per Month**: This query shows the count of infected assets over time, broken down by month. This is useful for tracking the trend and frequency of infections within the network. 3. **Open Case Status Distribution**: It gives a summary of open cases related to infections or threats in the network. This helps in understanding which issues are still unresolved and need immediate attention. 4. **Summary of Contacted Malicious Entities**: Lists all malicious entities that have been contacted through the assets. This is crucial for understanding the scope and nature of interactions with harmful sources. 5. **Base Events During the Last 24 Hours - Address Infection Drilldown, Hostname Infection Drilldown, Request Infection Drilldown**: Provides detailed breakdowns of infection events based on address, hostname, and request during the last 24 hours. This is useful for real-time monitoring and analysis of recent infections or suspicious activities. 6. **Zero Day Attacks/All Zero Day Attacks Currently Stored**: Lists all zero-day attacks currently recorded in the system. These are unpatched vulnerabilities that attackers exploit immediately upon discovery, making them highly dangerous. 7. **Internal Assets Targeted by Zero Day Attacks**: Identifies internal assets that have been targeted by zero-day attacks. This helps in prioritizing patches and updates to prevent future attacks on these systems. ### Reports: 1. **Overview/Access to Dangerous Destinations by Exploit Types**: Analyzes access patterns related to exploit types and dangerous destinations. It helps understand how intrusions are being carried out via different exploits targeting specific destinations. 2. **Reputation Data Analysis/Reputation Domain Entries, Reputation Domain Exploit Type Distribution, Reputation Domain Score Histogram, Reputation Domain Type Distribution**: Provides detailed analysis of reputation data for domains. This includes entries related to malicious or risky domains and the types of exploits they are associated with. 3. **Dangerous Browsing/Dangerous Browsing Activities - 30 Day Trend, One Year Trend, During the Last 24 Hours - Long Form, Short Form, During the Last 7 Days**: Tracks trends and activities related to dangerous browsing over different timeframes. This helps in identifying risky websites that employees might be accessing during work hours. 4. **General Scenarios/All Events for which a Scenario was Identified during the Last 7 Days, All Inbound and Outbound Malicious Communication during the Last 7 Days, List of Internal Assets with Malicious Communication during the last 7 Days, Malicious Communication Trend over Time of the Last 7 Days**: Covers scenarios related to malicious communication within internal assets. This is crucial for monitoring potential data breaches or unauthorized access attempts. 5. **Internal Assets Found in Reputation Data/Internal Assets Found in Reputation Data**: Lists all internal assets identified through reputation data analysis. This helps in understanding which systems are associated with risky domains and need attention to improve security posture. ### Summary: The report from Trend Micro Reputation Security Monitor 1.5 is a powerful tool for organizations looking to monitor their digital assets' security health. It provides detailed insights into potential threats such as infected assets, malicious entities, zero-day attacks, dangerous browsing activities, and more. By addressing these queries and analyzing the reports, organizations can better protect themselves against cyber threats and enhance overall network security posture.

Details:

The "ESM & Express Reputation Security Monitor 1.5" is a comprehensive security tool designed to monitor and protect against various cyber threats such as malicious communication, infected assets, dangerous sources, destinations, and more. It includes multiple modules that provide real-time monitoring, reporting, and analysis of network activities to detect potential risks and vulnerabilities in the system. Key features include: 1. **Active Channel Reputation Security Monitor**: Monitors all events on active channels for recent malicious communication matches, interactions with infected assets within the last 2 hours, and detection of interactions with malicious entities. 2. **Active List Reputation Security Monitor**: Tracks access from dangerous sources such as malicious host names involved in zero-day attacks or accessing dangerous destinations like browsing exploit types. 3. **Dashboard Reputation Security Monitor**: Provides an overview of various scenarios including geographical view of malicious communications, internal infections, and details on the health status of the security resources. 4. **User Defined Reputation Data**: Allows users to define additional malicious domains and IP addresses for more targeted monitoring and protection. 5. **Support Modules**: Includes advanced content and support for RepSM (Reputation Security Monitor), ensuring comprehensive assistance in managing and optimizing the tool's performance. This tool is designed to help organizations maintain a secure network environment by identifying and mitigating potential threats, protecting internal assets, and enhancing overall security posture against malicious activities. The document provides an overview of the "Reputation Security Monitor 1.5" dashboard, which is designed to analyze various aspects of reputation, security, and system health. The dashboard comprises several sections that focus on different elements of digital security, including:

• **Reputation Data Analysis**: This includes databases for domains and IP addresses, providing an overview of the status and trends in these areas. Additionally, it covers zero day attacks, which are vulnerabilities exploited before a patch is available.

• **Zero Day Attacks**: Monitors recent occurrences and provides an overview of such attacks.

• **Dangerous Browsing**: Tracks most recent dangerous browsing activities, highlighting potential threats to system security through internet usage.

• **Overview of Malicious Entities**: Covers access from malicious sources (both internal and external) and attacks initiated by such entities.

• **Internal Infected Assets**: Identifies systems potentially compromised within the network.

• **Rule Health**: Details of rules triggered recently, errors in these rules, states of the rules, and the top firing rules.

• **Trend Health**: Analytics on recent queries that did not return results or had failures, along with query duration and statuses.

• **Event Statistics**: Analyzes events based on access from dangerous sources, to dangerous destinations, internal infected assets, zero day attacks, and messages from model import connectors.

• **Updates**: Information about when the reputation domain list and IP list were last updated, as well as update counts over an 8-hour period.

The dashboard also includes several field sets that collect specific data related to events with source or target reputation information, internal infections, domain and IP enrichment from malicious sources, request URL enrichments, and system event details. Additionally, there are filters for accessing dangerous sources and destinations, providing more granular insights into potential security threats. The document titled "Filter Reputation Security Monitor 1.5" covers a wide range of scenarios and features related to cybersecurity, specifically focusing on the detection of dangerous destinations, browsing activities, and interactions with malicious domains and IPs. Here's a summary of its key components:

• **Dangerous Destinations and Browsing**: This section deals with outbound communication to malicious IP addresses (Outbound Communication to Malicious IPs) and URL requests to malicious domains (Outbound URL Requests to Malicious Domains). It also includes interactions with dangerous destinations, rule firings related to these interactions.

• **Dangerous Browsing**: Focuses on activities that indicate browsing towards potentially harmful or malicious websites, including rule firings for dangerous browsing events.

• **Events Enrichment with Reputation Data**: This part involves the enrichment of events with reputation data, particularly from malicious sources and targets, as well as requests to malicious hosts.

• **General Scenarios**: Covers various general scenarios related to dangerous inbound (Dangerous Inbound Communication), outbound (Dangerous Outbound Communication) communications, potential spear phishing attacks, internal infected assets, attacker and target host names present, among others.

• **Internal Assets Found in Reputation Data**: This section deals with traffic involving hosts or IPs found within the reputation data, which could indicate risky activities.

• **Malicious Communications**: Specifically highlights inbound communication from malicious domains/IPs, outbound communication to high-reputation domains/IPs, and requests to high-reputation domains.

• **Non Public-Facing Internal Targets**: Addresses internal traffic that is not facing the public internet, which could be involved in risky communications.

The document seems to be part of a security tool or system designed to monitor and report on potential threats related to dangerous browsing and communication patterns, providing detailed insights into how these are detected and categorized based on reputation data and other indicators. This setup is crucial for organizations looking to protect their digital assets from cyber threats by identifying and mitigating risks associated with inbound and outbound communications that interact with malicious or high-risk domains and IP addresses. The document outlines various features and functionalities of a software tool called "Filter Reputation Security Monitor 1.5." This tool is designed to monitor and manage security related activities within an organization's network, specifically targeting internal infected assets and potential threats such as malicious IPs, domains, and exploits. Here's a summary of the different sections and their purposes:

• **Internal Infected Assets**: Monitors outbound communication to malicious IP addresses and requests to malicious domains. It also identifies critical request domain exploit types and target reputation domain exploit types related to internal assets. Additionally, it handles case creation or removal for infected assets, as well as inbound and outbound communication reputation.

• **Zero Day Attacks**: Focuses on identifying zero day attacks by tracking reputation domain and IP exploit types. It also deals with the management of these attacks and rule firings.

• **RepSM Package Health Status**: Includes events monitored from dangerous sources, destinations, and infected assets. It tracks health status including query duration, failure rates, and trend runs. Also covers rule firing events and engine events within the RepSM package.

• **Reputation Database Analysis**: Monitors changes in reputation domains and IPs, indicating potential security breaches or modifications that could impact network integrity.

• **Integration Commands and Configuration**: Enables searching selected items in Google, using TippingPoint SMS for quarantine and unquarantine actions on sources and destinations.

• **Profile Sections**: Cover investigations into the behavior of internal infected assets, complex attacks, potential intrusions, and zero day attacks.

• **Query Section**: Provides data on access from dangerous sources over the last 24 hours, categorized by reputation type during the same period.

This tool is intended to provide comprehensive insights into network security vulnerabilities, enabling proactive measures to be taken against potential threats posed by infected assets and malicious activities. The document provides a comprehensive overview of various security-related activities monitored by Query Reputation Security Monitor 1.5, focusing on access from dangerous sources and browsing activities that may pose risks to an organization's network or assets. Here is a summarized breakdown of the queries available within this report: ### Access from Dangerous Sources: 1. **All Occurrences of Access from Dangerous Sources Currently Stored**: Lists all instances where there has been access from potentially dangerous sources in the system. 2. **Daily Count of Access from Dangerous Sources During the Last 7 Days**: Provides a daily tally of such occurrences over the past week. 3. **Summary of Dangerous Sources**: Offers a summary report on the types and frequency of sources identified as dangerous. 4. **Summary of Internal Assets Accessed by Dangerous Sources**: Details which internal assets have been accessed by these dangerous sources, highlighting potential vulnerabilities or breaches. 5. **Top Accessed Assets During the Last 24 Hours**: Identifies the top assets most frequently accessed from dangerous sources over the last day. ### Access to Dangerous Destinations: 1. **All Access to Dangerous Destinations Currently Stored**: Includes all recorded instances of access to potentially harmful destinations. 2. **All Base Events During the Last 24 Hours for Zero Day Attacks and Access**: Lists events related to potential zero-day attacks or unauthorized access attempts to dangerous destinations. 3. **All Correlation Events on Dangerous Browsing and Access to Dangerous Destinations**: Shows how browsing activities relate to accessing dangerous destinations, potentially indicating malicious intent. 4. **Communications from Internal Assets to Dangerous Destinations**: Details the internal assets (computers, servers, etc.) that have communicated with harmful external sites or services. 5. **Daily Communications with Dangerous Destinations During the Last 7 Days**: Provides a weekly summary of such communications. 6. **Dangerous Browsing and Interactions with Dangerous Destinations - Trend Base**: Tracks trends in browsing activities on potentially risky sites over time. 7. **Dangerous Destinations Accessed by Internal Assets**: Lists which external destinations have been accessed by the internal network assets, aiding in risk assessment. 8. **Distribution of Dangerous Destination Exploit Types**: Analyzes the types of exploits or vulnerabilities used to access dangerous destinations. 9. **Distribution of Dangerous Destination Types**: Categorizes the nature and type of sites accessed as potentially harmful. 10. **Interactions with Dangerous Destinations in the Last 24 Hours**: Captures immediate interactions with dangerous destinations over the last day. 11. **Internal Assets Communicated with Dangerous Destinations**: Identifies which internal systems have had communications or attempted access to dangerous external sites. 12. **Top 10 Dangerous Destinations Accessed by Most Internal Assets During the Last 24 Hours**: Highlights the most frequently accessed harmful destinations over the last day, ranked according to their usage frequency among internal assets. 13. **Top 10 Dangerous Destinations Most Accessed During the Last 24 Hours**: Lists the top ten dangerous sites that have been accessed by internal assets in the past 24 hours. 14. **Top Assets Interacted Most with Dangerous Destinations During the Last 24 Hours**: Identifies the most frequently interacted-with dangerous destinations from an asset perspective over the last day. ### Dangerous Browsing: 1. **All Browsing Activities Currently Stored**: Records all browsing activities detected by the system, potentially indicating potential risky behavior. 2. **Communications from Internal Assets to Dangerous Sites**: Details any internal communication or interaction with harmful external sites during browsing sessions. 3. **Daily Dangerous Browsing Activities During the Last 7 Days**: Provides a weekly summary of these activities. 4. **Dangerous Browsing Activities During the Last 7 Days**: A report on risky browsing behaviors over the past week. 5. **Dangerous Browsing Activities in the Last 24 Hours**: Captures immediate instances of dangerous or suspicious browsing within the last day. 6. **Dangerous Browsing Activities per Reputation Type During the Last 24 Hours**: Analyzes how different types of risky behavior are represented over time. 7. **Dangerous Browsing Activities per Reputation Type During the Last 30 Days, One Year**: Reports on trends in risky browsing behaviors over extended periods. This document serves as a crucial tool for maintaining network security by identifying and addressing potential threats from sources that may be dangerous or malicious. The "Query Reputation Security Monitor 1.5" provides a comprehensive analysis of network security by monitoring browsing activities on internal assets, including the identification and tracking of dangerous websites accessed by these assets over varying periods such as last one year, last 30 days, last week (24 hours and 7 days), and specific events like inbound or outbound communications within the past day, week, and trend analysis. Key features include:

• Tracking dangerous browsing activities on internal IP addresses and domains to detect potential security threats.

• Monitoring the top destinations accessed by these assets during specified timeframes.

• Identifying problematic assets based on their involvement in risky online behaviors.

• Analyzing communication issues, inbound or outbound events that may affect system integrity.

• Providing trend analysis for both overall network behavior and specific asset performance to inform security strategies.

• Detailed reports on malicious activities detected by reputation data from internal IP addresses and domains involved in browsing activities.

• Integration of threat intelligence to predict potential risks associated with internal assets' internet usage.

• Compliance support through detailed logs that can be audited for regulatory requirements or business needs.

The provided list of queries pertains to a comprehensive analysis and monitoring system known as "Query Reputation Security Monitor 1.5," designed for internal network security. This tool is used to detect, track, and report on various aspects related to infected assets within an organization's network. Key functionalities include:

• Monitoring interactions and communications involving infected assets over the last 24 hours and during the past month.

• Tracking infection types and statuses of open cases on internal infected assets.

• Analyzing access patterns to dangerous destinations, including specific types over the last 7 days.

• Providing detailed reports on reputation scores for IP addresses, domains, and entries within the organization's network database.

• Reporting on changes in domain reputations over different time periods (last week, one year), categorized by exploit type if applicable.

• Monitoring infected assets that have been active for more than a week.

• Tracking interactions with malicious entities detected during the last 24 hours and overall within the system.

This suite of queries is designed to provide real-time insights into network security posture, identify potential threats, and assist in managing risks associated with internal asset infections. The document titled "Reputation IP Changes," "Reputation IP Count During the Last 1 Week," "Reputation IP Count During the Last 1 Year," and similar titles pertains to an analysis of internet protocol (IP) addresses related to security incidents, specifically focusing on zero-day attacks. This data is compiled through a database named "Reputation Security Monitor 1.5." The report tracks various aspects such as changes in IP reputation over time, counts of specific exploit types involving these IPs, and details about the nature and frequency of these attacks across different periods (last week, year, etc.). Additionally, it provides insights into assets most targeted during certain times, internal asset summaries, and open case statuses related to zero-day attacks. This data is crucial for understanding cybersecurity trends, identifying potential threats from malicious IPs, and assessing the effectiveness of security measures implemented. The document "Query Viewer Reputation Security Monitor 1.5" provides various queries and reports that help in monitoring security incidents such as access from dangerous sources, communication with malicious hosts, and infected assets. Key queries include: 1. Access from Dangerous Sources: This section includes queries about all occurrences of accessing resources from potentially harmful origins, including internal assets accessed by dangerous sources, dangerous sites accessed by internal assets, trends in such accesses, and more. 2. Access to Dangerous Destinations: It involves monitoring access to destinations considered risky, such as communication with infected or malicious hosts. This includes querying for all stored instances of accessing dangerous destinations, browsing activities on potentially harmful sites, correlation events between browsing and accessing dangerous destinations, and trends in these accesses. 3. General Scenarios: These queries cover general security scenarios related to malicious communications from or towards internal assets over the last 7 days, including system events and communication matches with malicious hosts. 4. Internal Assets Found in Reputation Data: This part of the document focuses on querying information about internal IP addresses and domains found within reputation data, such as all events involving these assets within the last 24 hours or related to host name information. 5. Internal Infected Assets: It involves monitoring communications with infected assets, including inbound and outbound communication, infection base events, and overall system events related to infected internal assets during the last day and 24 hours. These queries are designed to provide a comprehensive view of potential security threats within an organization's network, helping in identifying risks associated with accessing or communicating from dangerous sources. The provided query and report names are related to a security monitoring tool called "Query Viewer Reputation Security Monitor 1.5." This tool appears to be used for analyzing and visualizing data related to potential cyber threats, such as infected assets, malicious entities, zero-day attacks, dangerous browsing activities, and more. Here is a summarized breakdown of the queries and reports: **Queries:** 1. **Internal Infected Assets/Currently Infected Assets and Recorded Interactions with Malicious Entities**: Lists currently infected assets along with their interactions with malicious entities. 2. **Infected Asset Count per Month**: Shows the count of infected assets over time, broken down by month. 3. **Open Case Status Distribution**: Provides a summary of open cases related to infections or threats in the network. 4. **Summary of Contacted Malicious Entities**: Lists all malicious entities that have been contacted through the assets. 5. **Base Events During the Last 24 Hours - Address Infection Drilldown, Hostname Infection Drilldown, Request Infection Drilldown**: Provides detailed breakdowns of infection events based on address, hostname, and request during the last 24 hours. 6. **Zero Day Attacks/All Zero Day Attacks Currently Stored**: Lists all zero-day attacks currently recorded in the system. 7. **Internal Assets Targeted by Zero Day Attacks**: Identifies internal assets that have been targeted by zero-day attacks. **Reports:** 1. **Overview/Access to Dangerous Destinations by Exploit Types**: Analyzes access patterns related to exploit types and dangerous destinations. 2. **Reputation Data Analysis/Reputation Domain Entries, Reputation Domain Exploit Type Distribution, Reputation Domain Score Histogram, Reputation Domain Type Distribution**: Provides detailed analysis of reputation data for domains. 3. **Dangerous Browsing/Dangerous Browsing Activities - 30 Day Trend, One Year Trend, During the Last 24 Hours - Long Form, Short Form, During the Last 7 Days**: Tracks trends and activities related to dangerous browsing over different timeframes. 4. **General Scenarios/All Events for which a Scenario was Identified during the Last 7 Days, All Inbound and Outbound Malicious Communication during the Last 7 Days, List of Internal Assets with Malicious Communication during the last 7 Days, Malicious Communication Trend over Time of the Last 7 Days**: Covers scenarios related to malicious communication within internal assets. 5. **Internal Assets Found in Reputation Data/Internal Assets Found in Reputation Data**: Lists all internal assets identified through reputation data analysis. These queries and reports are part of a security monitoring system designed to help identify, track, and respond to potential cyber threats by providing detailed insights into infected assets, malicious activities, and dangerous browsing patterns. This report provides a comprehensive overview of the security posture and reputation data analysis for assets monitored by the "Reputation Security Monitor 1.5." The report includes detailed information on internal infection, asset interactions with malicious entities, changes in the reputation database, zero-day attacks, and potential threats such as dangerous browsing, port scans, and peer-to-peer communications. It also covers scenarios related to access from dangerous sources and destinations, including inbound and outbound communications to and from malicious domains and IPs. The report is designed to help identify and respond to potential security risks, ensuring the protection of assets and networks against malicious activities. The document outlines various rules and trends within the Trend Micro Reputation Security Monitor (RPM) version 1.5, which is designed to detect and manage security risks associated with infected assets, malicious domains, IP addresses, zero-day attacks, and dangerous browsing behaviors. Key components include: 1. **Rule Reputation Security Monitor 1.5**: This section covers specific rules for detecting internal infected assets through outbound communications to malicious domains and IPs, as well as requests to such domains. Additionally, it includes rules for handling zero-day attacks related to successful inbound communications from malicious addresses, domains, or sources. 2. **Trend Reputation Security Monitor 1.5**: This section deals with broader trends in access from dangerous sources (including zero-day attacks) and interactions to dangerous destinations (such as browsing). It also includes analysis of reputation data changes for both domains and IPs. 3. **Use Case Reputation Security Monitor 1.5**: This part focuses on practical applications such as dangerous browsing, event enrichment with reputation data, general scenarios involving internal assets found in reputation data, infected assets monitoring, and a comprehensive overview of the RPM system itself. It also covers package health status and analysis of reputation domain changes or IP address changes. The document is intended for security professionals and provides detailed guidelines on how to manage and mitigate risks associated with these threats as outlined by HP Confidential (subject to use restriction).

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.