SOC Prime SIEM & EDR | 6 중 5 번째 페이지

ArcSight. EPS 최적화 (집계 및 필터링)

10월 23, 2017

거의 모든 ArcSight 초보자들은 로그 소스에서 높은 EPS(초당 이벤트 수)가 들어올 때, 특히 라이선스 한계에 가깝거나 성능 문제가 발생할 때 상황에 직면하게 됩니다. 들어오는 EPS를 줄이기 위해 ArcSight는 이벤트 처리를 위한 두 가지 기본 방법인 이벤트 집계와 필터링을 제공합니다. 이 기사에서는 이 두 가지 옵션을 사용하여 들어오는 EPS를 최적화하는 방법을 설명하고자 합니다. 이벤트 집계 첫 […]

추가 데이터로 이벤트 강화하기

10월 19, 2017

이전 글에서는 우리가 살펴보았습니다 추가 데이터 필드 그리고 그것들을 어떻게 사용하는지. 하지만 이벤트에 필요한 정보가 추가 데이터 필드에도 없다면 어떻게 해야 할까요? ArcSight에서 이벤트가 분석가들에게 모든 필요한 정보를 포함하지 않는 상황에 항상 직면할 수 있습니다. 예를 들어, 사용자 이름 대신 사용자 ID, 호스트 이름 대신 호스트 ID 등입니다. 확실히, 분석에서 Active List를 사용하고 알림/상관 이벤트에 […]

IBM QRadar에서의 구성, 이벤트 및 콘텐츠 백업

10월 17, 2017

SIEM을 사용하다 보면 도구를 최신 버전으로 업데이트하거나, 다른 데이터 센터로 이동하거나, 더욱 생산성 있는 설치로 마이그레이션해야 하는 상황이 종종 발생합니다. 이 과정의 필수적인 부분은 백업을 생성하고, 데이터, 설정 또는 사용자 지정 콘텐츠를 새 설치로 전송하는 것입니다. 이를 수행하는 몇 가지 방법이 있습니다. 옵션 1: 구성 백업 IBM QRadar 웹 콘솔에서 실행할 수 있습니다. 1. 다음으로 […]

Splunk 대시보드와의 간단한 바이러스 토탈 통합

10월 16, 2017

단순 통합은 악성 프로세스를 검색하는 데 도움이 됩니다. 안녕하세요 여러분! Splunk를 다목적 도구로 계속 변모시켜 어떤 위협도 신속하게 탐지할 수 있도록 하겠습니다. 제 마지막 기사에서는 경고를 사용하여 상관 이벤트를 생성하는 방법을 설명했습니다. 이제 Virus Total 기반과 간단한 통합을 하는 방법을 알려드리겠습니다. 우리 중 많은 사람들이 네트워크 연결을 모니터링하고, 프로세스를 생성하며, 파일 생성 시간의 변경 사항을 […]

IBM QRadar에서 이벤트 필터링

9월 01, 2017

SIEM 도구(IBM QRadar 포함)를 설정하는 동안, 관리자들은 종종 오류를 범합니다: “모든 로그를 SIEM으로 보내고, 나중에 어떻게 처리할지 고민하자.” 이러한 행동은 대개 엄청난 라이선스 사용, SIEM 도구에 대한 엄청난 작업량, 캐시 큐의 출현, 때로는 이벤트 손실로 이어집니다. 결과적으로 SIEM은 사건을 너무 늦게 등록하거나 전혀 등록하지 못하는 상황에 이르게 됩니다. 이 문제를 어떻게 해결할 수 있을까요? 주요 […]

자산 및 중요 인프라 객체 설명하기

8월 10, 2017

IBM QRadar를 구현하고 사용할 때, 사용자들은 종종 다음과 같은 질문을 합니다: 자산이란 무엇인가? 왜 필요한가? 우리는 자산으로 무엇을 할 수 있는가? 자산 모델을 자동으로 채우는 방법은? ‘자산’은 인프라를 설명하고 지정된 객체와 관련된 이벤트에 대해 IBM QRadar 시스템이 다르게 반응할 수 있게 하는 모델입니다. 규모와 심각도의 증가뿐만 아니라 응답도 시스템의 오탐을 최소화하고 인프라의 중요한 객체와 관련된 […]

Splunk에서 알림을 사용하여 상관 관계 이벤트 생성하기

8월 07, 2017

많은 SIEM 사용자들은 다음과 같은 질문을 합니다: Splunk과 HPE ArcSight SIEM 도구는 어떻게 다른가요? ArcSight 사용자는 ArcSight의 상관 이벤트가 이 SIEM을 사용하는데 있어 중요한 이유라는 점에 자신감을 가지고 있습니다. 왜냐하면 Splunk에는 같은 이벤트가 없기 때문입니다. 이 신화를 파괴해 봅시다. Splunk에는 이벤트를 상관시킬 수 있는 많은 옵션이 있습니다. 그래서 이 기사에서는 ArcSight 상관 이벤트와 유사한 이벤트 […]

ArcSight ESM에서 추가 데이터

8월 04, 2017

ArcSight SmartConnector를 설치한 적이 있는 모든 사람은 설치 가이드의 ‘ArcSight 필드로의 디바이스 이벤트 매핑’ 장에 대해서 알고 있습니다. 이는 디바이스-특정 필드를 ArcSight 이벤트 스킴으로 매핑하는 정보가 제공되는 곳입니다. 분석가들에게는 필수적인 장이죠, 그렇지 않나요? 확실히, 일부 SmartConnector에 대해 ‘추가 데이터’ 필드가 있다는 것을 눈치채셨을 겁니다. 예를 들어:어디서 나오는 걸까요? 왜 우리가 그것들을 필요로 할까요? 어떻게 사용해야 […]

네트워크 계층구조란 무엇이며 IBM QRadar에서 사용하는 방법

8월 03, 2017

네트워크 계층 구조는 조직의 네트워크 내부 모델에 대한 설명입니다. 네트워크 모델을 통해 서버 세그먼트, DMZ, 사용자 세그먼트, Wi-Fi 등 네트워크의 모든 내부 세그먼트를 설명할 수 있습니다. 이 데이터는 등록된 보안위반 사건의 데이터를 풍부하게 하는 데 필요하며, 규칙, 검색, 필터 및 보고서에서 네트워크 모델 데이터를 사용할 수 있으며, 정확한 리소스 식별을 위해 필요합니다.

ArcSight의 액티브 리스트 자동 삭제. 1부

8월 02, 2017

ArcSight 초보자와 경험이 많은 사용자들은 종종 사용 사례에서 액티브 리스트를 자동으로 지워야 하는 상황에 직면합니다. 이러한 시나리오가 있을 수 있습니다: 모든 사용자의 오늘 로그인 횟수를 실시간으로 세거나 지정된 시간에 액티브 리스트에 있는 몇몇 카운터를 초기화합니다.

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.

SIEM & EDR

Follow us on:

Archive

Tags