Symantec Event Collector for Microsoft Internet Authentication Service (IAS) version 4.2 Quick Reference

Transcription

1 Symantec Event Collector for Microsoft Internet Authentication Service (IAS) version 4.2 Quick Reference

2 Symantec Event Collector for Microsoft Internet Authentication Service (IAS) Quick Reference The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2007 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, LiveUpdate, Symantec AntiVirus, and Symantec Security Response are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. Microsoft, Windows, Windows 2000, Windows 2003, and Windows XP are trademarks or registered trademarks of Microsoft Corporation. This product includes software that was developed by the Apache Software Foundation. Other brands and product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are hereby acknowledged. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation Stevens Creek Blvd. Cupertino, CA USA

4 Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product feature and function, installation, and configuration. The Technical Support group also authors content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s maintenance offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization A telephone and web-based support that provides rapid response and up-to-the-minute information Upgrade insurance that delivers automatic software upgrade protection Global support that is available 24 hours a day, 7 days a week worldwide. Support is provided in a variety of languages for those customers that are enrolled in the Platinum Support program Advanced features, including Technical Account Management For information about Symantec s Maintenance Programs, you can visit our Web site at the following URL: Contacting Technical Support Customers with a current maintenance agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to recreate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information

5 Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration Customer service If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade insurance and maintenance contracts Information about the Symantec Value License Program Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals

6 Maintenance agreement resources Additional Enterprise services If you want to contact Symantec regarding an existing maintenance agreement, please contact the maintenance agreement administration team for your region as follows: Asia-Pacific and Japan: Europe, Middle-East, and Africa: North America and Latin America: Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, expertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Symantec Early Warning Solutions These solutions provide early warning of cyber attacks, comprehensive threat analysis, and countermeasures to prevent attacks before they occur. Managed Security Services Consulting Services Educational Services These services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring and management capabilities, each focused on establishing and maintaining the integrity and availability of your IT resources. Educational Services provide a full array of technical training, security education, security certification, and awareness communication programs. To access more information about Enterprise services, please visit our Web site at the following URL: Select your country or language from the site index.

7 Contents Technical Support Chapter 1 Chapter 2 Chapter 3 Introducing Symantec Event Collector for Microsoft Internet Authentication Service (IAS) About this Quick Reference... 9 Compatibility requirements Compatibility requirements for Microsoft IAS System requirements for the collector computer Preinstallation requirements for Microsoft IAS Event Collector About configuring Microsoft IAS to work with the collector About the installation sequence for Microsoft IAS Event Collector Sensor configuration for Microsoft IAS Event Collector Sensor settings for Microsoft IAS Event Collector Implementation notes Implementation notes for Microsoft IAS Event Collector Product ID Method of data collection Schema packages Example data Event mapping for Information Manager version Event filtering and aggregation Event filtering and aggregation for Microsoft IAS Event Collector Index

8 8 Contents

9 Chapter 1 Introducing Symantec Event Collector for Microsoft Internet Authentication Service (IAS) This chapter includes the following topics: About this Quick Reference Compatibility requirements Preinstallation requirements for Microsoft IAS Event Collector About configuring Microsoft IAS to work with the collector About the installation sequence for Microsoft IAS Event Collector Sensor configuration for Microsoft IAS Event Collector About this Quick Reference This quick reference includes information that is specific to Symantec Event Collector for Microsoft Internet Authentication Service (IAS). General knowledge on installing and configuring collectors is assumed, as well as basic knowledge of Microsoft IAS. For detailed information on how to install and configure event collectors, please see the Symantec Event Collectors Integration Guide. For information on Microsoft IAS, see your product documentation.

10 10 Introducing Symantec Event Collector for Microsoft Internet Authentication Service (IAS) Compatibility requirements Compatibility requirements The collector is compatible with specific versions of the security product and is compatible with certain operating systems. Compatibility requirements for Microsoft IAS The collector is compatible with Microsoft Internet Authentication Service (IAS), which is included with Microsoft Windows. The collector runs on the following operating systems: Microsoft Windows 2000 with Service Pack 4 or later Microsoft Windows 2000 Advanced Server with Service Pack 4 or later Microsoft Windows 2003 Server Enterprise Edition with Service Pack 1 or later Microsoft Windows 2003 Server Standard Edition with Service Pack 1 or later System requirements for the collector computer The computer on which you install the collector must meet the following minimum system requirements: Intel Pentium-compatible 133-MHz processor (up to and including Xeon-class) 512 MB minimum, 1 GB of memory recommended for the Agent 35 MB of hard disk space for collector program files 95 MB of hard disk space to accommodate the Agent, the JRE, and the collector TCP/IP connection to a network with a fixed IP address Preinstallation requirements for Microsoft IAS Event Collector The collector does not have preinstallation requirements. About configuring Microsoft IAS to work with the collector Microsoft IAS does not require special configuration to make event information available to the collector.

11 Introducing Symantec Event Collector for Microsoft Internet Authentication Service (IAS) About the installation sequence for Microsoft IAS Event Collector 11 About the installation sequence for Microsoft IAS Event Collector The collector installation sequence is as follows: Close the Symantec Security Information Manager Client console. Register the collector. Install the Agent. Install the collector component. For more information, see the Symantec Event Collectors Integration Guide. Sensor configuration for Microsoft IAS Event Collector The collector uses a sensor that must be configured to receive security events. After the sensor is configured, the settings must be distributed to the collectors on the target computers. The collector cannot use the configuration that is named Default. You must create a new one. For more information, see the Symantec Event Collectors Integration Guide. Sensor settings for Microsoft IAS Event Collector The collector uses a log file sensor. The sensor has the following properties: Log file directory Specify the path to the log file on the security product computer. The default log file directory is server_directory/profiles/profile/logs/ See About configuring Microsoft IAS to work with the collector on page 10. Log File Name Specify the name of the log file. The default log file name is trace.log. You can leave this property blank to read all files in the log file directory. Reading Mode Specify whether the collector checks for new log files after reaching the end of the current log file or waits for new events to be added to the current log file.

12 12 Introducing Symantec Event Collector for Microsoft Internet Authentication Service (IAS) Sensor configuration for Microsoft IAS Event Collector Specify Monitor Dynamic Log for the collector to check for a new log file to read. Start Reading From Specify End to read the log file from the end of the file upon the restart of the collector. Specify Last Position for the collector to keep track of which line the collector is reading in the log file. If the collector is interrupted and restarted, reading continues from this position. When the collector is started for the first time, the collector reads all events in all files. Last position is the default value. Time Offset This property is not in use at this time.

13 Chapter 2 Implementation notes This chapter includes the following topics: Implementation notes for Microsoft IAS Event Collector Implementation notes for Microsoft IAS Event Collector This section describes the implementation details for Microsoft IAS Event Collector. Product ID The product ID for the collector is Method of data collection Schema packages The collector uses a log file sensor to collect events. The collector uses the following schema packages: Base events IDS events Network events Example data The following is an example event:

14 14 Implementation notes Implementation notes for Microsoft IAS Event Collector "AUSRAVPNPS310","RAS",02/20/2007,00:00:03,1,"Americas\aaron_musa", "amer.sym.com/austin/users/aaron_musa",," ",,,, " ",67,," ",,,,5,,1,2,4,"ISA Server Default Policy",0," /16/ :10: ",,,,,,,,,,,,,,,,,,3,1," ",,,,,,,,"MSRASV5.20",311,,,,,"Use Windows authentication for all users",1,,, "MSRAS-0-WXP-6WQSMB1","MSRASV5.10","AUSRAVPNPS310","RAS",02/20/2007, 00:00:03,2,,"amer.dell.com/Austin/Users/Aaron_Musa",,,,,,,,,,,,,,, 1,2,4,"ISA Server Default Policy",0," /16/ :10: ",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"0x00414D ", 14,2,"Use Windows authentication for all users",1,,,, The following describes the structure of the event: Computer-Name,Service-Name,Record-Date,Record-Time,Packet-Type, User-Name,Fully-Qualifed-User-Name,Called-Station-Id, Calling-Station-Id,Callback-Number,Framed-IP-Address, NAS-Identifier,NAS-IP-Address,NAS-Port,Client-Vendor, Client-IP-Address,Client-Friendly-Name,Event-Timestamp,Port-Limit, NAS-Port-Type,Connect-Info,Framed-Protocol,Service-Type, Authentication-Type,NP-Policy-Name,Reason-Code,Class,Session-Timeout, Idle-Timeout,Termination-Action,EAP-Friendly-Name,Acct-Status-Type, Acct-Delay-Time,Acct-Input-Octets,Acct-Output-Octets,Acct-Session-Id, Acct-Authentic,Acct-Session-Time,Acct-Input-Packets, Acct-Output-Packets,Acct-Terminate-Cause,Acct-Multi-Session-Id, Acct-Link-Count,Acct-Interim-Interval,Tunnel-Type,Tunnel-Medium-Type, Tunnel-Client-Endpt,Tunnel-Server-Endpt,Acct-Tunnel-Connection, Tunnel-Pvt-Group-ID,Tunnel-Assignment-ID,Tunnel-Preference, MS-Acct-Auth-Type,MS-Acct-EAP-Type,MS-RAS-Version,MS-RAS-Vendor, MS-CHAP-Error,MS-CHAP-Domain,MS-MPPE-Encryption-Types, MS-MPPE-Encryption-Policy,Proxy-Policy-Name,Provider-Type, Provider-Name,Remote-Server-Address,MS-RAS-Client-Name, MS-RAS-Client-Version,Computer-Name2,Service-Name2,Record-Date2, Record-Time2,Packet-Type2,User-Name2,Fully-Qualifed-User-Name2, Called-Station-Id2,Calling-Station-Id2,Callback-Number2, Framed-IP-Address2,NAS-Identifier2,NAS-IP-Address2,NAS-Port2, Client-Vendor2,Client-IP-Address2,Client-Friendly-Name2, Event-Timestamp2,Port-Limit2,NAS-Port-Type2,Connect-Info2, Framed-Protocol2,Service-Type2,Authentication-Type2,NP-Policy-Name2, Reason-Code2,Class,Session-Timeout2,Idle-Timeout2,Termination-Action2, EAP-Friendly-Name2,Acct-Status-Type2,Acct-Delay-Time2, Acct-Input-Octets2,Acct-Output-Octets2,Acct-Session-Id2, Acct-Authentic2,Acct-Session-Time2,Acct-Input-Packets2, Acct-Output-Packets2,Acct-Terminate-Cause2,Acct-Multi-Session-Id2,

15 Implementation notes Implementation notes for Microsoft IAS Event Collector 15 Acct-Link-Count2,Acct-Interim-Interval2,Tunnel-Type2, Tunnel-Medium-Type2,Tunnel-Client-Endpt2,Tunnel-Server-Endpt2, Acct-Tunnel-Connection2,Tunnel-Pvt-Group-ID2,Tunnel-Assignment-ID2, Tunnel-Preference2,MS-Acct-Auth-Type2,MS-Acct-EAP-Type2, MS-RAS-Version2,MS-RAS-Vendor2,MS-CHAP-Error2,MS-CHAP-Domain2, MS-MPPE-Encryption-Types2,MS-MPPE-Encryption-Policy2, Proxy-Policy-Name2,Provider-Type2,Provider-Name2, Remote-Server-Address2,MS-RAS-Client-Name2,MS-RAS-Client-Version2 Event mapping for Information Manager version 4.5 Table 2-1 shows the Information Manager field name, the Microsoft IAS Event Collector field name, and how they are used. Table 2-1 Information Manager field name Category ID Configuration Description Destination Host Name Event Date Event Type ID EventClassName Intrusion Context Intrusion Data Intrusion Intent Event mapping Microsoft IAS Event Collector field name NP-Policy-Name Computer-Name Record-Date + Record-Time Fully-Qualifed-User-Name Packet-Type Comment Security Specifies the category of the event Name of the server policy Description of the intrusion activity Name of the destination computer that is being intruded Timestamp of the event Network Intrusion Event Set to symc_network_intrusion for authorization events Fully qualified user name that tried to get access Server packet type Overall intent of the attempted intrusion activity

16 16 Implementation notes Implementation notes for Microsoft IAS Event Collector Table 2-1 Information Manager field name Intrusion Outcome Intrusion Packet Intrusion Protocol Intrusion Vendor Name IP Destination Address IP Destination Port IP Source Address Severity ID Target Resource User Name Vendor Signature Event mapping (continued) Microsoft IAS Event Collector field name Service-Name Client-IP-Address NAS-Port Calling-Station-Id User-Name User-Name Reason-Code2 Comment Outcome of the attempted intrusion activity: Succeeded Failed Intrusion packet description including all headers Protocol that is associated with the attack Possible values: PPP SLIP ARAP SingleLink/MultiLink IPX/SLIP Name of the service IP address of the destination computer that is being intruded Destination port of the computer that is being intruded Source IP address of the intruding system Specifies the severity of the event Possible values: 1 - Informational 3 - Minor User name User name Microsoft IAS server response

17 Chapter 3 Event filtering and aggregation This chapter includes the following topics: Event filtering and aggregation for Microsoft IAS Event Collector Event filtering and aggregation for Microsoft IAS Event Collector The collector includes a filter named not_translated that is enabled by default. The not_translated filter removes events where not_translated is true. Because of the role that intrusion-detection point products such as Microsoft IAS play in defense-in-depth scenarios, filtering or aggregation on these types of events is not recommended. However, it is possible that systems on a network play a specific role to ensure the security of an organization. This type of role may result in false positives from the device. For example, computers within the network that are responsible for assessing vulnerability risks may use techniques that cause intrusion-detection point products to report that the network is under attack. If you have this type of scenario, you may consider aggregating the events from that computer. This aggregation is based on the IP Source Address value in the Common Event folder. You may also consider securing the network by aggregating or filtering events from this computer that are consistently fired by the role the computer plays on the network. This aggregation is based on the vendor code of the events you want to filter.

18 18 Event filtering and aggregation Event filtering and aggregation for Microsoft IAS Event Collector

19 Index C compatibility requirements 10 configuring sensor 11 I implementation notes 13 installation 11 M mapping 13 P preinstallation requirements 10 R requirements compatibility 10 preinstallation 10 system 10 S sensor configuration 11 system requirements 10