Arcsight Correlation PDF

Precision Intelligence
SmartRules and Cross-Correlation
HIGHLIGHTS: CONSOLIDATE, FILTER, AND CROSS-CORRELATE ALL NETWORK SECURITY EVENTS
Pre-configured correlation for immediate results

Easy to use rules authoring to deal with new infrastructure
and new threats
Time based cross-device and cross-event correlation to
eliminate false positives and false negatives
Real-time and forensic rules execution to use the power of

correlation for both detection and investigation
Wide variety of actions tied to rule matches for efficient
response and resolution
Detailed event display and drill down for immediate
diagnosis
Benefits
Embedded Correlation
ArcSight has implemented a powerful, flexible and easy-to-use
ArcSight comes with an extensive set of SmartRules in place and
SmartRules engine to support multi-dimensional correlation of the
ready to process events. These rules are designed to capture threats
data that has been collected via the SmartAgents deployed through-
and attacks that are typical in large, diverse networks and are organ-
out the network. Because the collected data is normalized into a com-
ized to provide multiple lines of defense by detecting specific activi-
mon event database, correlation can be performed utilizing any field
ties and grouping them according to level of threat:
including:
Geography
Device type
Source
Target
Time thresholds
Event type
SmartRules define which events generate an alert, when those events
generate an alert, and what actions are associated with the alert.
Hence each SmartRule contains event conditions, thresholds, and
actions. When incoming events match rule conditions and thresholds,
the ArcSight SmartRule automatically fires the action that has been
defined. Actions can include:
Reconnaissance
zone transfer, port scan, protocol, scanning, etc.
Suspicion
illegal outgoing traffic, unusual levels of alerts

from the same host, etc.
Attack
Compromise
overflow, IDS evasion, virus, DoS, etc.

successful backdoor, root compromise,
covert channel, etc.
This embedded security expertise ensures that the ArcSight solution

will be immediately productive.
Vendor Independent Rules
ArcSight has grouped similar events and signatures into Rule
Categories that can be utilized by the SmartRules to insultate the rule
from changes in vendor-specific event details. For example, event
Execute a pre-determined command or script
names may change between product releases or new devices may be
Log the alert
added to the infrastructure with a new set of nomenclature. Since the
Send the alert to the Console
Rule Categories map similar signatures into a single name that is
Send the alert to the notification designee
used by the SmartRules, if an individual device changes taxonomy,
Set custom severity for the alert based on cumulative activity
only the mapping is changed, not the rule definition. Therefore,
Add a source to a suspicious list or a target to a vulnerable list
despite changes in individual devices, the investment in SmartRules
A combination of these actions
is preserved. Rule Categories also enable ArcSight to initiate correlation as soon as installation is complete.
Security Management for the Enterprise
CGI BUFFER OVERFLOW

FROM NT SERVER
RULE FIRES
FAILED LOGIN FROM SNORT IDS
INDIVIDUAL EVENT DETAIL
ARCSIGHT CROSS-DEVICE CORRELATION
Powerful Scripting Language

To avoid the problems of hard-coded alarm thresholds and scoring
When action is required, ArcSight provides a full set of tools and
systems, ArcSight provides a flexible scripting language that allows for
services for the operator. Resources such as the rule definition, a
easy creation of new SmartRules and the alteration and updating of
Knowledge Base article containing company policies and recommended
existing rules. The ArcSight Rules Language uses simple logic opera-
actions and the development of a complete case docket describing
tors such as AND and OR to create SmartRules which can be stored
the problem assist the operator in responding immediately to critical
and executed in the ArcSight Manager or on individual Consoles. Since
security threats. If necessary, the operator can proactively deal with
ArcSight processes both real-time and historical data, the correlation
an attack by launching specific applications or scripts from the
can be set up to execute in either of these modes as well.
Console to reconfigure device settings or change access privileges.
If(an ids evasion attack) occurs (from the same source ip address) (3
Contact Information
times) within (2 minutes) then (send message to console) and (notify
For more information, please contact:
the security supervisor via pager)

ArcSight, Inc.
ArcSight SmartRules reduce False Positives and Identify Real Threats
1309 S. Mary Avenue

Sunnyvale, CA 94087
Precision Intelligence For Confident, Aggressive Action
Email: securitysolutions@arcsight.com
Correlation via SmartRules ensures that credible threats and attacks
Phone: (408) 328-5500
come to the attention of the security staff on a high-priority basis.

Hence once an alert is received, the operator can perform in-depth
analysis and take aggressive action secure in the knowledge that the
effort is well spent. When a SmartRule match is reported to the
ArcSight Console, the analyst can quickly drill down and see all of the
individual events that caused it to fire. If necessary, the analyst can
investigate even further to see all of the individual data elements
captured for those events.

Arcsight Correlation PDF

Uploaded by

Copyright:

Available Formats

Arcsight Correlation PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Arcsight Correlation PDF

Uploaded by

Copyright:

Available Formats

Precision Intelligence

SmartRules and Cross-Correlation

HIGHLIGHTS: CONSOLIDATE, FILTER, AND CROSS-CORRELATE ALL NETWORK SECURITY EVENTS

Pre-configured correlation for immediate results

Real-time and forensic rules execution to use the power of

ArcSight has implemented a powerful, flexible and easy-to-use

ArcSight comes with an extensive set of SmartRules in place and

SmartRules engine to support multi-dimensional correlation of the

ready to process events. These rules are designed to capture threats

ized to provide multiple lines of defense by detecting specific activi-

mon event database, correlation can be performed utilizing any field

ties and grouping them according to level of threat:

zone transfer, port scan, protocol, scanning, etc.

illegal outgoing traffic, unusual levels of alerts

overflow, IDS evasion, virus, DoS, etc.

This embedded security expertise ensures that the ArcSight solution

Execute a pre-determined command or script

names may change between product releases or new devices may be

Log the alert

added to the infrastructure with a new set of nomenclature. Since the

Send the alert to the Console

Rule Categories map similar signatures into a single name that is

Send the alert to the notification designee

used by the SmartRules, if an individual device changes taxonomy,

Set custom severity for the alert based on cumulative activity

only the mapping is changed, not the rule definition. Therefore,

Add a source to a suspicious list or a target to a vulnerable list

despite changes in individual devices, the investment in SmartRules

A combination of these actions

Security Management for the Enterprise

CGI BUFFER OVERFLOW

INDIVIDUAL EVENT DETAIL

ARCSIGHT CROSS-DEVICE CORRELATION

Powerful Scripting Language

When action is required, ArcSight provides a full set of tools and

systems, ArcSight provides a flexible scripting language that allows for

services for the operator. Resources such as the rule definition, a

easy creation of new SmartRules and the alteration and updating of

Knowledge Base article containing company policies and recommended

actions and the development of a complete case docket describing

tors such as AND and OR to create SmartRules which can be stored

the problem assist the operator in responding immediately to critical

and executed in the ArcSight Manager or on individual Consoles. Since

security threats. If necessary, the operator can proactively deal with

ArcSight processes both real-time and historical data, the correlation

an attack by launching specific applications or scripts from the

can be set up to execute in either of these modes as well.

Console to reconfigure device settings or change access privileges.

times) within (2 minutes) then (send message to console) and (notify

For more information, please contact:

the security supervisor via pager)

1309 S. Mary Avenue

Precision Intelligence For Confident, Aggressive Action

Correlation via SmartRules ensures that credible threats and attacks

Phone: (408) 328-5500

come to the attention of the security staff on a high-priority basis.

You might also like