POC_M04_02_ESM_Use Cases_DataSources.pptx

mcafee data source

1. Data Sources -Overview -Use Case & Labs

2. Module Topics Receiver Data Sources Parent/Child//Client Data Sources Auto Learn Data Sources Data Source Profiles Configuring Common Data Sources Receiver Data Source Configuration

3. Receiver Data Sources Receiver Data Source Settings are used to control how event and log data is collected by the Receiver Common formats for data sources include Syslog (both UDP and TCP) WMI SNMP Snare or the McAfee Agent for Windows logs MEF – McAfee Event Formats for custom log settings Netflow (generic Netflow, sFlow) McAfee currently supports over 450 different data sources Receiver Data Source Configuration

4. Data Sources – Parent / Child / Client Documentation on this is unclear and is in the process of being cleaned-up Child and Client can be used interchangeably. That said, the Parent : Child/Client relationship can be exemplified as follows: Example 1: Customer is gathering a stream from SYSLOG-NG (Parent) that has a mix of devices ( Children or Clients) behind it. Example 2: Customer has added ePO as a Data Source (The Parent). Each Agent Type (VSE, HIPS, etc) would appear as children or clients. Receiver Data Source Configuration

5. Data Sources – Parent/Child/Client (Continued) How many Parent & Child/Client Data Sources can be configured on a receiver? As of v9.2, there are 3 rules that dictate how much a physical receiver can handle : The maximum # of devices is 1000. This can be split between the parent and the child /client data sources. Each parent can have up to 255 child/client data sources, so the maximum number of data sources per receiver is 1000 * 255, or 255,000. Real-world experience tells us that the EPS rating on the receiver will be exceeded before we actually hit these type of numbers. Receiver Data Source Configuration

6. Data Sources – Parent/Child/Client Properties of Child/Client Data Sources: Supports Syslog , ASP, CEF, WMI, or Custom Will not have VIPS, Policy, or Agent rights. Will not be displayed on the Receiver Properties > Data Sources table Will appear on the System Navigation Tree Will share the same policy and rights as the parent data source. Must be in the same time zone since they use the parent's configuration. Children/Clients have the ability to set an independent time zone. WMI is an exception because the time zone is determined by the query sent to the WMI server; therefore, Child, Client WMI data sources can have independent time zones . Receiver Data Source Configuration

7. Match on Type vs. IP Customer is gathering a stream from SYSLOG-NG (Parent) that has a mix of devices ( Children/Clients) behind it . 2 options exist ( syslogng & splunk ). The key is that the syslog source needs to be RFC-3164 compliant for us to identify data in the stream and to uncover the source IP from the header. Match on Type Matches data based on the type of data contained in the stream. If you have a single device that is collecting data from other devices and then forwarding to the Receiver, you might want to use Match on Type Match on IP Used for the same kind of devices sending the same kind of log data which only differs by the IP address of the sending device. Receiver Data Source Configuration

8. Receiver Properties – Add Data Source Receiver Data Source Configuration 1 2 3 Select the receiver you are applying the data source setting to . Select the Receiver properties . From the Receiver Properties listing, select ‘Data Sources’

9. System Navigation – Add Data Source Receiver Data Source Configuration 1 2 Select the receiver you are applying the data source setting to . After selecting the Receiver, select the Add Data Source icon.

10. Data Sources Screen The Data Sources screen is the starting point for configuring the settings for all data sources You can add, add a child, edit, and remove data sources from this screen along with defining many other specific configuration settings It indicates whether or not Parsing, Logging, and SNMP Trap are enabled and allows you to change the settings for these options for each data source

11. Data Sources Screen Advanced – Allows a custom data source to be added, view the custom data sources in place Auto Learn – Allows the system to learn unknown IP addresses with the option to add each of them as a data source. Does not provide for automatic adding of data sources, due to the possibility of a rogue intruder using this to launch a DOS attack against a Receiver by spoofing packets. Upload – This allows for a syslog file to be collected by the receiver. Write – This options writes the current, updated data source configuration to the Receiver. Any changes made to the Data Source Settings are not utilized until they are written to a Receiver.

12. Data Sources – Auto Learn Receiver Data Source Configuration 1 2 This feature provides the capability for the Receiver to learn data sources automatically

13. Data Sources – Auto Learn Receiver Data Source Configuration NOTE The default setting is 0, which means Auto Learn will run continuously

14. Auto-Learn Notes Auto-Learn is NOT an automated process. It will attempt to discover what is out on the network and report what it has found in time specified. Once the table has been completed, adding discovered devices is a manual process. As of v9.2, there is about a 75% accuracy rate on what “Type” of device is found. Future releases pending to cover an “Automated Add” option as well as better identification of what is discovered.

15. Add Data Source Settings Receiver Data Source Configuration Once you select the option to add a data source, you are taken to the Add Data Source menu. As you select different options, additional parameters may become available for selection and configuration

16. Adding a Client Data Source Receiver Data Source Configuration 3 1 2 If Match on IP is selected, enter the IP address for the client. If Match on type is selected, select the type of data source in the Data Source Vendor and Data Source Model fields.

17. Adding a Child Data Source Receiver Data Source Configuration 1 2 NOTE Child data sources count against the maximum number of data sources allowed for your Receiver

18. Data Source Profiles Receiver Data Source Configuration Profiles can be set for Data Source, Event Forwarding, Network Discovery, SNMP Trap, Vulnerability Assessments, and Remote Share

19. System Profiles are accessed through the ESM Settings and selecting Profile Management. Y ou can add a new profile, edit an existing profile, or remove an existing one. Profiles can be set for Data Source, Event Forwarding, Network Discovery, SNMP Trap, Vulnerability Assessment, and Remote Share. Data Source Profiles Receiver Data Source Configuration 2 1 3

20. Data Source Profiles - SNMP Receiver Data Source Configuration 1 2 For an SNMP Profile you will need to enter the agent type, profile name, and the community name If SNMP v3 is selected, authentication information will need to be entered as appropriate.

21. Data Source Profiles - Windows Receiver Data Source Configuration Windows Profile: Profile Name : Enter a name used to refer to and select the profile Username : The username used to access the windows logs for this server group. Password : Password which corresponds to the username. Event Logs : Enter the names of the windows logs you wish to collect. Common values are SYSTEM, APPLICATION and SECURITY. Interval : Duration at which the server using this profile will be polled by the WMI collection mechanism. 1 2

22. Data Source Types There are several data source types, each of which have unique capabilities and usage Advanced Syslog Parser (ASP) Provides a mechanism for parsing data out of syslog messages based on user defined rules McAfee Event Format (MEF) Provides a structure for external programs to insert events in the most efficient manor ArcSight Common Event Format (CEF) Allows parsing of events that are formatted in CEF Windows Management Instrumentation (WMI) Provides support for the infrastructure for management data and operations on Windows-based operating systems Receiver Data Source Configuration

23. Data Source Specific Settings Several Data Sources will have additional settings which will show based on the Device Vendor and Device Model Settings, including : Syslog or CEF Protocol Check Point (OPSEC Protocol) Cisco IDS (4.x+ protocol) ISS Microsoft WMI Event Log Netflow McAfee SNMP SDEE Receiver Data Source Configuration

24. Hidden Receiver Data Source Configuration

25. Data Sources - WMI Receiver Data Source Configuration WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM) as defined by the Distributed Management Task Force (DMTF ) It is the primary management technology for Windows operating systems, permitting management information to be shared between management applications The ability to obtain management data from remote computers is what makes WMI useful

26. Data Sources Syslog Receiver Data Source Configuration Syslog data may come from a variety of sources, including network gear, firewalls, and UNIX Servers The Linux ASP parser provides a method to support generic syslog messages by creating custom rules in a Snort like format

27. Data Sources – Generic Net Flow Receiver Data Source Configuration Supports Versions 5, 7, and 9 Enabling forwarding is useful if you wish to forward your event data to a syslog or SNMP server To enable forwarding, check the Enable Forwarding checkbox provided and Add the Forwarding IP Address and Forwarding Port

28. Vulnerability Assessments Data Sources The Vulnerability Assessment (VA) option on the Receiver Properties screen allows you to integrate data that can be retrieved from a variety of vulnerability assessment vendors. VA data can be used for the following : Raise an event’s severity based on knowledge of the end point’s known vulnerability to that event Automatically learn assets and their attributes (OS and services detected ) Provide a mechanism to define Asset Filter Groups and allow you to create and manipulate the membership of user-defined Asset Groups Provide summary and drill-down information of the network assets Modify Policy Editor configuration (i.e., turn on MySQL signatures if an asset is discovered to be running MySQL). Receiver Data Source Configuration

29. Vulnerability Assessments Data Sources Currently, McAfee can integrate with the following vendors: eEye REM eEye Retina McAfee FoundStone Critical Watch FusionVM LanGuard Lumension nCircle Nessus NGS OpenVAS Qualys Rapid7 Metasploit Pro Rapid7 Nexpose Saint Receiver Data Source Configuration

30. Data Sources – Vulnerability Assessments Receiver Data Source Configuration 2 1 The Vulnerability Assessment feature allows you to retrieve data from a variety of vulnerability assessment (VA) vendors. In order to communicate with the desired VA sources, you will need to add the source to the system as well as edit it or remove it from the system when needed. Once a source has been added to the system, you can retrieve the VA data.

31. Data Sources – Add VA Source Receiver Data Source Configuration To add a VA source, you will need to: C onfigure communication parameters for the VA vendor S chedule parameters to dictate how often data should be retrieved, and modify event severity calculations

32. Data Sources – Enable VA Receiver Data Source Configuration If the Enable VA Source checkbox is unselected, the configuration settings for this data source will be saved on the ESM for further use, but the settings will not go to the Receiver when applying VA source settings.

33. McAfee ePO Receiver Data Source Configuration McAfee ePO is fully integrated via a direct database connection Y ou can set up multiple McAfee ePO data sources all pointing to the same IP address with different names in the database name field

34. Use Case # Defining & Adding Data Sources McAfee’s ESM allows organization’s to view the disparate, data generating elements in their environment into a single console for a uniform view. Customer Pain Point Solution / Business Value Devices and Data Sources Proliferate an Organizations architecture. Often times, each of these sources require accessing a standalone interface to understand what each device is “seeing” in the environment. How does an Security Analyst centralize this effort moving from a tactical to more strategic view?