built4tech

Once the ELM management database has been migrated to the preferred location(see previous post), we can set up ELM storage volumes to meet with the compliance and long time retention requirements of the organization. Storage volumes can be defined using the internal storage of the ELM the additional storage provided by a Direct Attach Storage device (DAS), as well as external Storage devices (like NFS resources or SAN). The definition of which Storage volume to use is set up by Data Source, a good practice in a shared environment, is to have one storage volume by customer. Once the storage volume is created and used, the management database of the ELM tracks all the information sent to this volume, this characteristic is specially interesting during the analysis phase as a new tab appear on the event details panel that link the parsed event with its raw information allowing forensic investigation. This video shows the whole process of defining multiple storage volumes, how ...

The Enterprise Log Manager (ELM) management database stores the records that track logs sent to the ELM. By default the management database is stored on the local disk of the ELM, it is a good practice to migrate the management database to an external location to be sure that it has enough space to maintain the track of the event sent to the ELM. The migration of the management database can takes several hours depending of the amount of information that it contains. It is a good practices to define the new location when you first set up the ELM device. The system allows to create two copies of the ELM database using the Mirror function during the migration process. Once the management database is located on the desire location we can start defining the different storage volumes for long time retention of information. The following video shows the migration process to an external NFS shared created explicitly to the management database. Next videos will show the creation of...

In this last video, I show how to create a parser for the SIEM to be able to understand the information received, and how to disable aggregation so each twitter message generates and unique event. This is a good way to maintain a continuous flow of events specially interested when performance is measured.

In this second video, I will show how to create a workflow blueprint. The workflow created, does the following steps: Collect information from twitter and filter them by some keywords, in order to do this certain credentials must be obtained from the twitter api (Consumer secret and access token secret), the sensible information is not shown on the video. Next step is pull key attributes, from the twitter json string, so we don't have to deal with the information we are not interested in, in this example I am extracting user name, language used and message information. Next, we check that it is in fact a twitter message and if so we route the information to the next step. Next , the traffic flow is transformed into a json string Last step is to send the information as the message string of a syslog event to the receiver. In the SIEM receiver we create a Data Source and log the unknown syslog information as unknown, in the next post I will create a parser so the...

From Wikipedia:  Apache NiFi   is a  software project from the Apache Software Foundation designed to automate the flow of data between software systems. In this set of videos I will show the process of installation of Nifi, configuration of a flow where I will collect information from twitter, then it will be transformed into a Json stream and last It will be sent to McAfee SIEM where a Data source will be previously created, in the last video of this series I will show how to create a custom parser to "understand" the information sent. The following video covers the installation process of Nifi, using docker. In order to download the docker image go to https://hub.docker.com/r/apache/nifi/ and follow the instructions, the video however covers the process.

In this post I will show you how to install McAfee SIEM and its most important components for the first time. These are the different components that I want to install: Enterprise Security Manager (ESM): This is the main component, contains the Embedded Data Base (EDB) which is the proprietary Data Base used by McAfee SIEM to store all the parsed information, and also the web application from which all the management of the platform (configuration, alerting, reporting) will be made. Enterprise Log Manager (ELM): This component response for the compliance use case, it is  in charge of storing the raw information for long time retention Receiver (ERC): Is the component that connect the Data sources, which the ESM and the ELM, data sources can send the information to the ERC (Ex. syslog data sources) or we can configure the RCV to collect information from the data sources (Ex. Windows Management Instrumentation) Advanced Correlation Engine (ACE), it is the component in charg...

In this video, you can see the how Wannacry works, specifically the killswitch. Basically a system affected by Wannacry tries to connect to the killswitch link, if it does the infection stops and the system does't get infected or the malware propagated. During the video  I modified the killswith to point to localhost in order to demonstrate how the systems reacts when the killswitch server is not available. The solution used during this video is McAfee Active Response (MAR), this solution is McAfee Endpoint Detection and Response (EDR) able to trace the activity done by the endpoint when a suspicious file is executed.  McAfee Active Response uses Open Data Exchange Layer (DxL) to share endpoint trace information and execute live search queries.