Quick Start Guide for Symantec Event Collector for ForeScout CounterACT

Transcription

1 Quick Start Guide for Symantec Event Collector for ForeScout CounterACT

2 Quick Start Guide for Symantec Event Collector for ForeScout CounterACT The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2013 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation 350 Ellis Street Mountain View, CA

4 Quick Start Guide for Symantec Event Collector for ForeScout CounterACT This document includes the following topics: About this quick reference Compatibility requirements for the ForeScout CounterACT event collector Sensor properties for the ForeScout CounterACT event collector Configuring ForeScout CounterACT point product Setting up ArcSight SmartConnector Event example for ForeScout CounterACT event collector About this quick reference This quick reference includes information that is specific to Symantec Event Collector for ForeScout CounterACT. General knowledge about installing and configuring collectors is assumed, as well as basic knowledge of ForeScout CounterACT. For information on ForeScout CounterACT, see your product documentation.

5 Compatibility requirements for the ForeScout CounterACT event collector 5 Compatibility requirements for the ForeScout CounterACT event collector For compatibility requirements, visit the MSS Customer Portal to view the Supported Products List (Symantec_MSS_Supported_Products_List.xlsx): Sensor properties for the ForeScout CounterACT event collector Table 1-1shows the SysLog sensor properties for the ForeScout CounterACT event collector. Note: Do not use the special characters such as <, &, and ' (single quotes) while naming a sensor. Table 1-1 Sensor property Sensor Name Protocol Host Names Port Number SysLog sensor properties Default value Sensor 0 UDP * Description Name of the sensor. Note: Do not use special characters such as <, &, and ' (single quotes) while naming a sensor. Syslog protocol that ForeScout CounterACT uses to send events. Host computer names or the IP addresses that the collector monitors. The default value '*' means all hosts. Specify * (or any) to allow any host to send events to the collector, or specify multiple host names. Separate multiple host names or IP addresses with commas or semicolons. The port number to which you have configured the point product to send sensor messages.

6 Configuring ForeScout CounterACT point product 6 The information located in Table 1-2 will be required for Symantec MSS to onboard the devices. Table 1-2 Sensor property SysLog sensor properties Default value Sensor Name Protocol Host Names Port Number Configuring ForeScout CounterACT point product After you have installed ForeScout CounterACT event collector, you need to configure the point product to make the log event information available to the collector. You must configure the following plugins: Syslog - To forward syslog log events Common event format (CEF) - To forward CEF log events

7 Configuring ForeScout CounterACT point product 7 To configure the Syslog plugin 1 Update default event types that Syslog client plugin uses to format and forward events to an external Syslog server. The default event types include Intrusion, Event Viewer, Network Integrity Policy, Audit Trails, and Uptime or Status. For example, you can send mark distribution events (bait) and scan events, only forward certain types of bite events, or send events at intervals other than the default. 2 Set the following Syslog client plugin configuration options: Syslog Address Syslog Port Identity Facility Priority Send all NAC Policy logs Specify Syslog server IP address. Specify Syslog UDP port number as The default value is 514. Enter CounterACT. Specify Syslog messages facility. The default value is local4. Specify Syslog messages priority. The default value is info. Select the checkbox. Note: NAC Policies in CounterACT can contain Actions to send custom syslog messages. For the collector to translate these messages correctly, they must be defined matching a specific format as follows: "<Policy name or description here>.host Information:IP Address:{ip} MAC Address: {mac} Host Name:{nbtdomain}/{nbthost} DNS Name:{hostname} Logged in User: {user}". 3 Configure the Events sent, first by entering event strings and suffix commands into the local.properties file. Next, by stopping and restarting the Syslog plugin. The suffix commands include.send,.format, and.frequency. For example, if you enter the event type Intrusion.Bait, the plugin applies the command suffix to all Intrusion Bait events. If you only enter the String Intrusion, the plugin applies the suffix command to all intrusion events. You can also enter strings that instruct the plugin to exclude events types or specific events.

8 Setting up ArcSight SmartConnector 8 4 Log in to the Scout or Management Server computer to open the local.properties file located at: /usr/local/forescout/plugin/syslog/local.properties. Basically you manage events exported by entering the events strings you want to control in the local.properties file and assigning a suffix command to each event. The suffix commands indicate whether to send or not certain types of events, or to define the frequency in which they are sent. 5 Stop and start the Syslog plugin to apply the changes that you made to the configuration. Advanced Configuration Tools let you Control which events are sent, Control the event message format, and Control the frequency that events are sent. For instance, To send only bite events, event.intrusion.send = false; event.intrusion.bite.send = true. Setting up ArcSight SmartConnector ForeScout CounterACT does not generate CEF formatted logs. You must use ArcSight SmartConnector to forward ForeScout CounterACT logs in CEF format. For more information on installing and configuring ArcSight SmartConnector, log into product website and see the Configuration details. Note: You must have login credentials to access the document. Event example for ForeScout CounterACT event collector An event example in CEF format is as follows: CEF:0 BlocksadsProduct CounterACTexample OS Fingerprint OS Fingerprint 2 dst= dmac=00:17:65:af:86:dd filepath=53\tcp Blocksads DNS ;1723\tcp (Firmware: 1) cs1=blocksads Host Attributes/ Classification/OS Fingerprint cs1label=os Fingerprint An event example in Syslog format is as follows: Nov 09 13:39: CounterACTexample[287]: Network Integrity Log: Source: , Rule: new service on host, Details: Data for

9 Event example for ForeScout CounterACT event collector 9 recheck resolved Host-Open Ports: 32777/TCP