ArcSight事件关联分析.pptVIP

*************Oncepatternsaregenerated,thesecuritygroupcanprocesstheminanumberofwaysdependingontheirdiagnosisofwhatthepatternistellingthem.Actionsincludeimmediatelyblockingtrafficorreconfiguringsystems,issuingtroubleticketsorusingotherTruThreattoolstofurtherinvestigateandmanagethesituation.TruThreatVisualization(thefunctionthatgraphicallydepictssource/target/eventrelationships)canbeusedtofurtherexplorethepatterns.AveryexcitinglinktoTruThreatCorrelationistheabilitytoautomaticallygenerateacorrelationruleifthebehaviorissomethingthatshouldbetrackedcontinuously.Thisauto-rulegenerationiscompletelyuniquetoArcSightanddramaticallyreducestheamountofeffortindevelopingnewrules.Anotherimportantby-productofPatternDiscoveryisthedevelopmentofa“normal”baselineofnetworkandsystemactivity.Aspatternsaredetectedandtriagedbythesecuritygroup,normalpatternsofactivitycanbeassignedtothebaselinesotheyarenotflaggedinthefuture.Thisbaselinecontinuestogrowovertimewhichmeanstheorganizationisbuildingalegacyofknowledgeaboutitsbehaviorsthatmakesthediscoverynewpatternsmoremeaningful.This“baselining”isaveryefficientwaytobringinneworganizationsintotheArcSightinfrastructure.Forexample,whenMSSP’saddanewcustomer,itisnotunusualforthemtoassignananalystfulltimeforseveralweekstodevelopasenseofwhatis“normal”forthatcustomer.WithTruThreatPatternDiscovery,thisprocessisnowdonewithminimaleffortoverthecourseofseveraldays.Thesameprocessappliestobringinginnewdivisionsorsubnets.一旦模式产生，安全组可以处理在一个根据其模式是什么，告诉他们多少他们的诊断方法。

行动包括：立即封锁交通或重新配置系统，发出故障单或使用其他TruThreat工具进一步调查和管理情况。

TruThreat可视化（图形描述的函数的源/目标/事件联系）可以用来进一步探索的模式。

一个非常令人兴奋的连结TruThreat关系是能够自动地生成一个相关的规则，如果该行为是应该被跟踪的事不断。这是自动生成的规则是完全独特的ArcSight，大大降低了开发新规则的努力量。

另一个重要的副模式发现产品是一个“正常”的网络和系统