Re: SIM solution - Objectives ?

On Fri, May 25, 2007 at 06:59:32PM +0530, saudi sans wrote:
> Thanks.
> 
> We have Windows , Unix hosts and Checkpoint Firewalls  being monitored.
> 
> Does anyone have list of items [ standalone or co-related ] which
> merit being monitored and alerted on these devices?

"Monitoring" is easy.  Store as much data as you can tolerate.  You
never know when data will turn out useful later.  If you have it, you
can use it.  If you don't have it, it's too late to turn it on.  If
you retain enough data and make it available to your ops people, they
will love you, because you will make their troubleshooting easier.

"Alerting" is much harder.  If you have specific lists of events you
must respond to for compliance -- N consecutive failed logins or the
like -- then obviously, they need to be on your list.  Other events
that really do merit being alerted on almost always depend on your
environment.  A successful login on a server at 2am on Sunday morning
might be a sign of alarm in an 8x5 environment, and totally OK in a
24x7 environment.  On a network that bans IRC, a logged IRC connection
is a sign of either a compromise or at least an AUP violation, but if
the network doesn't ban IRC, the same event is totally normal.
Creation of an admin account on a firewall might be ignored if you are
constantly adding/removing personnel, or it could be really bad if you
normally use TACACS+ or RADIUS.

What you normally want to do is get a report of what WOULD have
alerted on for a few weeks, and what wouldn't have been alerted.
Analyze the reports with a paranoid mind, and think about which ones
are ignorable in your environment, which ones are critical in your
environment, and which ones are context-dependent.  Have everything
not recognized alert, so that your alert list is actually maintained
over time instead of new events being ignored.  And if alerts are
automated, make sure to put in rate limiting!  You don't want to get
86400 alerts a day when something goes wrong.

- Morty