Re: Correlation Rules - BEST PRACTICES

Bruno Moraes wrote:
> Dear All,
> Good morning. I'm study about techniques of creation correlation rules. There are many log management tools in the market with native correlation rules in the software....
> I need create a list of correlation rules that isn't native in the sec tool to my environment.
> First Example that i thought: Create one correlation rule that alert when the users make duplicate login in the network..
> What you have seen as best practices about creation of correlation rules user-defined? What are the best examples?
> Other example: Log Integration between firewall x ids ... 
> Any suggestion?
> Many thanks for attention.
> Bernard
> 

Hi Bruno,

Tenable publishes our correlation rules in much the same way as we do
for Nessus vulnerability checks. The rules are written in a language
named TASL which is very similar to the NASL vulnerability scripting
language.

Writing a check looking for user login activity over time is very easy
to do with TASL. There are TASL scripts currently that automatically
build a list of all known users on each local system and can alert when
a "new" user is detected. If you had a list of accounts and wanted to
alert when some of these logged on multiple times or at the same time,
this would be easy to accomplish.

You can get a sense of the types of event correlation scripts available
by going here:
http://cgi.tenablesecurity.com/tasl.html

A white paper on the methodology behind the correlation rules as well as
documentation on TASL are also available here:
http://www.tenablesecurity.com/images/pdfs/LCE_tasl_scripts.pdf
http://cgi.tenablesecurity.com/LCE_2.0_TASL_reference_guide.pdf

There is also a webinar (requires registration) where we walk through
about 15 of these correlation scripts with examples:
http://www.tenablesecurity.com/demos/demo_webinars.shtml

Ron Gula, CTO
Tenable Network Security