AlienVault Unified Security Management (USM) 4.x-5.x. Deployment Planning Guide

Size: px
Start display at page:

Download "AlienVault Unified Security Management (USM) 4.x-5.x. Deployment Planning Guide"

Transcription

1 AlienVault Unified Security Management (USM) 4.x-5.x Deployment Planning Guide

2 USM 4.x-5.x Deployment Planning Guide, rev. 1 Copyright AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat Exchange, AlienVault OTX Reputation Monitor, AlienVault OTX Reputation Monitor Alert, AlienVault OSSIM, and OSSIM are trademarks or service marks of AlienVault, Inc. All other registered trademarks, trademarks or service marks are the property of their respective owners. Revision to This Document Date July 1, Revision Description Original document. Updated Table 2 with new URLs added in USM 5.1. USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 2 of 12

3 Contents Contents Introduction... 4 AlienVault USM Components... 4 USM Sensor... 4 USM Server... 5 USM Logger... 6 USM Deployment Types... 6 USM Deployment Examples... 7 Simple Deployment Example: USM All-in-One... 7 Simple Deployment Example: USM All-in-One and a Remote Sensor... 8 Complex Deployment Example: Individual USM Components... 9 Firewall Permissions USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 3 of 12

4 Introduction Introduction This guide is for use by AlienVault Unified Security Management (USM) 4.x and 5.x customers who must decide where to deploy the USM appliances on their network. It describes what the USM components are, how they work, as well as the URLs and port numbers that they need to access. AlienVault USM Components USM provides a single monitoring solution that combines several critical security technologies into a single appliance. Its modular architecture allows components to exist at any level of the network, thereby increasing system visibility and performance. All USM products include these three core components available as hardware or virtual appliances: USM Sensor - Deployed throughout the network to collect logs and monitor network traffic. Provides the five essential USM security capabilities for complete visibility. USM Server - Aggregates and correlates information that the Sensors gather. Provides single pane-of-glass management, reporting, and administration. (See USM Server.) USM Logger - Securely archives raw event log data for forensic research and compliance mandates. (See USM Logger.) Note: USM All-in-One (AIO) combines the Server, Sensor, and Logger components onto a single system. USM Sensor The USM Sensor deploys throughout the network, including any remote sites your organization has. It is referred to as the frontline security module of the USM platform. The USM Sensor combines five essential security capabilities that the AlienVault USM platform provides. This greatly expands situational awareness, creating visibility into deployed assets; vulnerabilities on those assets; attack targets and vectors; and services. USM Sensors specifically perform the following data aggregation tasks: Collects logs from network devices and hosts. Collects data on network traffic from mirrored ports. Performs asset discovery. Conducts vulnerability scanning. Collects intrusion detection data. Generates NetFlows. USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 4 of 12

5 AlienVault USM Components USM Sensors then translate ( normalize ) all received data into uniform format that they can act on. To normalize the raw data from disparate data sources, the USM Sensor uses individual plugins. Plugins parse the data and convert it into a readable format with multiple fields, which are called events in AlienVault USM. Finally the USM Sensor sends the normalized events to the USM Server where correlation and risk assessment occur. Data Aggregation and Detection Normalization Send to USM Server Figure 1. USM Sensor workflow USM Server The USM Server communicates with every component, and provides a single point for management, reporting, and administration. This management includes the following core functionality: Collects information forwarded by USM Sensors. Evaluates each event against USM default and customer specified policies. Performs risk assessment on every event. Correlates events to identify threat patterns. Generate alarms for evaluation and appropriate response. Stores events in a local database for assessment and reporting. USM Server correlates events by observing patterns based on logical operators such as OR and AND. It also cross-correlates events with existing vulnerability data. After the USM Server correlates events, it performs risk analyses and, if the risk for an event rises above 1, it triggers an alarm. See correlation on the AlienVault Documentation Center. Figure 2 shows the workflow of the USM Server. By default, the USM Sensor sends normalized events to the USM Server correlation engine, where risk assessment occurs. Organizations can configure policies to filter events, so that the USM Server analyzes only those events that are most important to the company. After correlation, the USM Server stores the events in the database for a short period. This allows for more correlation and incident response, if needed. Optionally, it can also forward events and alarms to another USM Server or a USM Logger. Event Collection Policy Evaluation Risk Assessment Correlation SQL Storage Event Forwarding (Optional) Figure 2. USM Server workflow USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 5 of 12

6 USM Deployment Types USM Logger The USM Logger acts as the secure data archive of the USM solution. It performs simple, but critical tasks: Stores security events and alarms as flat files on the system. Digitally signs and time-stamps it for integrity. Organizations can use this later for log validation an important feature for compliance. Stores events for long-term retention, analysis, and reporting with a 7:1 compression ratio. Indexes on full text in hourly runs, and offers fast log retrieval. (See note.) Users can access Logger data through the USM web interface to run reports, analyze trends, and conduct forensic research. Note: Full-text indexes are based on text-based columns (VAR, CHAR, or TEXT) and help speed up queries and DML operations on data in those columns, omitting defined stop words. Figure 3 shows the workflow of the USM Logger. USM Logger receives normalized events and alarms from USM Server. It then signs and archives them on the disk. Event Collection Log Signature Disk Storage Figure 3. USM Logger workflow USM Deployment Types AlienVault USM can generally be deployed in two ways: Simple Deployment All AlienVault USM components (Sensor, Server, and Logger) are deployed in a single appliance called USM All-in-One. Such deployment is useful for smaller environments as well as testing and demo purposes. Complex/Distributed Deployment AlienVault USM components are deployed onto its own appliance and are separated. In distributed deployment, AlienVault USM comes in two flavors, USM Standard and USM Enterprise, such as USM Standard Server, USM Standard Sensor, USM Enterprise Server, or USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 6 of 12

7 USM Deployment Examples USM Enterprise Logger. The USM Enterprise deployment is only available on hardware appliances. Enterprise Server ships with two devices, one device is the Enterprise Server and the other is the Enterprise Database. The AlienVault USM Standard and USM Enterprise product lines offer increased scalability and performance by provisioning dedicated systems for each component. Table 1. AlienVault USM Deployment Types USM All-in-One USM Standard USM Enterprise User Type Small organizations Mid-size organizations Large organizations Environment Single-tier deployment Multi-tier deployments & distributed environment Multi-tier deployments & distributed environment Virtual Appliance x x Hardware Appliance x x x See datasheets on alienvault.com for details. USM Deployment Examples You can deploy AlienVault USM appliances in small organizations, where a single USM All-in-One is sufficient; in mid-size organizations, where one or more USM Remote Sensors connect to a USM AIO; or in large organizations, where USM Sensor, USM Server, and USM Logger are separate physically but work as a single unit. Below are some examples with graphical illustrations. Simple Deployment Example: USM All-in-One In this example, a USM AIO is deployed behind the company firewall. The Sensor component on the AIO collects log from the office network, wireless network, DMZ network, as well as the firewalls. It also monitors the network traffic through the connected routers. The routers have port mirroring enabled. USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 7 of 12

8 USM Deployment Examples Figure 4. Simple deployment example: USM AIO Simple Deployment Example: USM All-in-One and a Remote Sensor This example is very similar to the previous one, but this company has a remote office that s on a different subnet. In this case, the best practice is to deploy a USM Remote Sensor at the remote office, and deploy the USM AIO on the main network. This way the remote sensor can collect logs and monitor traffic specific to the subnet, then send them to the AIO for correlation and risk assessment. USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 8 of 12

9 USM Deployment Examples Figure 5. Simple deployment example: USM AIO and a remote sensor Complex Deployment Example: Individual USM Components In this complex example, each office subnet has a remote sensor deployed to collect logs and monitor traffic. On the main network, instead of using the USM AIO, each USM component is installed on its own appliance to increase scalability and performance. All USM Sensors connect to the USM Server, where correlation and risk assessment occur. The USM Server forwards the events and alarms to the USM Logger for long-term storage. USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 9 of 12

10 Firewall Permissions Figure 6. Complex deployment example: individual USM components Firewall Permissions The USM components need to access certain URLs and port numbers to function correctly. If your company operates in a highly secure environment, you will need to change some permissions on your firewall(s) for USM to work. Table 2 summarizes the URLs and port numbers that the USM needs access to, while Table 3 lists the port numbers used by the USM components to communicate with each other. Table 2. URLs and port numbers used by USM Server URL Port Number AlienVault Features in Use USM versions data.alienvault.com 80 AlienVault product and feed update 4.x and 5.x feed.openvas.org, openvas.org 80, 873 Vulnerability Assessment 4.x maps-api-ssl.google.com 443 Asset Location 4.x and 5.x messages.alienvault.com 443 Message Center 5.x USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 10 of 12

11 Firewall Permissions Server URL Port Number AlienVault Features in Use USM versions otx.alienvault.com 443 Open Threat Exchange 5.1 and above reputation.alienvault.com 443 Open Threat Exchange 4.x and 5.x support.alienvault.com 20, 21 AlienVault Doctor 4.x and 5.x telemetry.alienvault.com 443 Telemetry Data Collection 5.x tractorbeam.alienvault.com 22, 443 Remote Support 5.x 80 AlienVault API 4.x and 5.x *The AlienVault API tries to access every 5 minutes to ensure that the system has Internet connection. Table 3. Port numbers used by the USM components for internal communication USM Components Package Name Listening Port Description Server, Sensor alienvault-firewall 22 alienvault-snmpd 161, 162 alienvault-vpn <VPN_PORT> When VPN is enabled, the alienvault-vpn package will add a rule to open the specified port. By default it is alienvault-ha 873, 694, 3306, 4949, 9390, 3000 When High Availability (HA) is enabled, the alienvault-ha package will add rules to open these ports between the two nodes as well as on the virtual IP. Server alienvault-mysql 3306 ossim-server 40001, 40002, 40004, alienvault-apache2 80, 443 ossim-framework 40003, 40011, 3128, 555(udp) alienvault-ntop 3000 USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 11 of 12

12 Firewall Permissions USM Components Package Name Listening Port Description Sensor alienvault-ossec 1514(udp) ossim-agent 514(udp), 4949, 9390 USM 4.x-5.x Deployment Planning Guide, rev. 1 Page 12 of 12

Module 1: Overview. Module 2: AlienVault USM Solution Deployment. Module 3: AlienVault USM Basic Configuration

Module 1: Overview. Module 2: AlienVault USM Solution Deployment. Module 3: AlienVault USM Basic Configuration Module 1: Overview This module provides an overview of the AlienVault Unified Security Management (USM) solution. Upon completing this module, you will meet these objectives: Describe the goal of network

More information

Module 2: AlienVault USM Basic Configuration and Verifying Operations

Module 2: AlienVault USM Basic Configuration and Verifying Operations Course Introduction Module 1: Overview The Course Introduction provides learners with the course objectives and prerequisite learner skills and knowledge. The Course Introduction presents the course flow

More information

AlienVault. Unified Security Management (USM) 5.1 Running the Getting Started Wizard

AlienVault. Unified Security Management (USM) 5.1 Running the Getting Started Wizard AlienVault Unified Security Management (USM) 5.1 Running the Getting Started Wizard USM v5.1 Running the Getting Started Wizard, rev. 2 Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault

More information

The SIEM Evaluator s Guide

The SIEM Evaluator s Guide Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,

More information

AlienVault Unified Security Management (USM) 4.15-5.x. Configuring High Availability (HA)

AlienVault Unified Security Management (USM) 4.15-5.x. Configuring High Availability (HA) AlienVault Unified Security Management (USM) 4.15-5.x Configuring High Availability (HA) USM v4.15-5.x Configuring High Availability (HA), rev 1 Copyright 2015 AlienVault, Inc. All rights reserved. The

More information

AlienVault Unified Security Management Solution Complete. Simple. Affordable Life Cycle of a log

AlienVault Unified Security Management Solution Complete. Simple. Affordable Life Cycle of a log Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

AlienVault. Unified Security Management 5.x Configuring a VPN Environment

AlienVault. Unified Security Management 5.x Configuring a VPN Environment AlienVault Unified Security Management 5.x Configuring a VPN Environment USM 5.x Configuring a VPN Environment, rev. 3 Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,

More information

AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals

AlienVault. Unified Security Management (USM) 5.x Policy Management Fundamentals AlienVault Unified Security Management (USM) 5.x Policy Management Fundamentals USM 5.x Policy Management Fundamentals Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,

More information

Monitoring VMware ESX Virtual Switches

Monitoring VMware ESX Virtual Switches Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

AlienVault. Unified Security Management 5.x Configuration Backup and Restore

AlienVault. Unified Security Management 5.x Configuration Backup and Restore AlienVault Unified Security Management 5.x Configuration Backup and Restore USM 5.x Configuration Backup and Restore Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,

More information

Suricata IDS. What is it and how to enable it

Suricata IDS. What is it and how to enable it Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

Deploying HIDS Client to Windows Hosts

Deploying HIDS Client to Windows Hosts Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

User Management Guide

User Management Guide AlienVault Unified Security Management (USM) 4.x-5.x User Management Guide USM v4.x-5.x User Management Guide, rev 1 Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,

More information

How to send emails triggered by events

How to send emails triggered by events Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

How to configure High Availability (HA) in AlienVault USM (for versions 4.14 and prior)

How to configure High Availability (HA) in AlienVault USM (for versions 4.14 and prior) Complete. Simple. Affordable How to configure High Availability (HA) in AlienVault USM Copyright 2015 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM,

More information

Device Integration: CyberGuard SG565

Device Integration: CyberGuard SG565 Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

Unified Security Management and Open Threat Exchange

Unified Security Management and Open Threat Exchange 13/09/2014 Unified Security Management and Open Threat Exchange RICHARD KIRK SENIOR VICE PRESIDENT 11 SEPTEMBER 2014 Agenda! A quick intro to AlienVault Unified Security Management (USM)! Overview of the

More information

AlienVault Unified Security Management (USM) 4.x-5.x. Deploying HIDS Agents to Linux Hosts

AlienVault Unified Security Management (USM) 4.x-5.x. Deploying HIDS Agents to Linux Hosts AlienVault Unified Security Management (USM) 4.x-5.x Deploying HIDS Agents to Linux Hosts USM 4.x-5.x Deploying HIDS Agents to Linux Hosts, rev. 2 Copyright 2015 AlienVault, Inc. All rights reserved. AlienVault,

More information

Configuring a VPN Environment in USM v4.x

Configuring a VPN Environment in USM v4.x Complete. Simple. Affordable Copyright 2015 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

Intrusion Detection in AlienVault

Intrusion Detection in AlienVault Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

Device Integration: Checkpoint Firewall-1

Device Integration: Checkpoint Firewall-1 Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

Unified Security Management

Unified Security Management Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy

More information

Assets, Groups & Networks

Assets, Groups & Networks Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

QRadar Security Intelligence Platform Appliances

QRadar Security Intelligence Platform Appliances DATASHEET Total Security Intelligence An IBM Company QRadar Security Intelligence Platform Appliances QRadar Security Intelligence Platform appliances combine typically disparate network and security management

More information

IBM Security. 2013 IBM Corporation. 2013 IBM Corporation

IBM Security. 2013 IBM Corporation. 2013 IBM Corporation IBM Security Security Intelligence What is Security Intelligence? Security Intelligence --noun 1.the real-time collection, normalization and analytics of the data generated by users, applications and infrastructure

More information

LOG MANAGEMENT AND SIEM FOR SECURITY AND COMPLIANCE

LOG MANAGEMENT AND SIEM FOR SECURITY AND COMPLIANCE PRODUCT BRIEF LOG MANAGEMENT AND SIEM FOR SECURITY AND COMPLIANCE As part of the Tripwire VIA platform, Tripwire Log Center offers out-of-the-box integration with Tripwire Enterprise to offer visibility

More information

SIEM Optimization 101. ReliaQuest E-Book Fully Integrated and Optimized IT Security

SIEM Optimization 101. ReliaQuest E-Book Fully Integrated and Optimized IT Security SIEM Optimization 101 ReliaQuest E-Book Fully Integrated and Optimized IT Security Introduction SIEM solutions are effective security measures that mitigate security breaches and increase the awareness

More information

QRadar SIEM 6.3 Datasheet

QRadar SIEM 6.3 Datasheet QRadar SIEM 6.3 Datasheet Overview Q1 Labs flagship solution QRadar SIEM is unrivaled in its ability to provide an organization centralized IT security command and control. The unique capabilities of QRadar

More information

LOG AND EVENT MANAGEMENT FOR SECURITY AND COMPLIANCE

LOG AND EVENT MANAGEMENT FOR SECURITY AND COMPLIANCE PRODUCT BRIEF LOG AND EVENT MANAGEMENT FOR SECURITY AND COMPLIANCE The Tripwire VIA platform delivers system state intelligence, a continuous approach to security that provides leading indicators of breach

More information

The Purview Solution Integration With Splunk

The Purview Solution Integration With Splunk The Purview Solution Integration With Splunk Integrating Application Management and Business Analytics With Other IT Management Systems A SOLUTION WHITE PAPER WHITE PAPER Introduction Purview Integration

More information

Unified Security Management (USM) 5.2 Vulnerability Assessment Guide

Unified Security Management (USM) 5.2 Vulnerability Assessment Guide AlienVault Unified Security Management (USM) 5.2 Vulnerability Assessment Guide USM 5.2 Vulnerability Assessment Guide, rev 1 Copyright 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,

More information

Device Integration: Cisco Wireless LAN Controller (WLC)

Device Integration: Cisco Wireless LAN Controller (WLC) Complete. Simple. Affordable Device Integration: Cisco Wireless LAN Controller (WLC) Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM,

More information

IBM QRadar Security Intelligence Platform appliances

IBM QRadar Security Intelligence Platform appliances IBM QRadar Security Intelligence Platform Comprehensive, state-of-the-art solutions providing next-generation security intelligence Highlights Get integrated log management, security information and event

More information

Detect & Investigate Threats. OVERVIEW

Detect & Investigate Threats. OVERVIEW Detect & Investigate Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics Enterprise-wide

More information

LOG INTELLIGENCE FOR SECURITY AND COMPLIANCE

LOG INTELLIGENCE FOR SECURITY AND COMPLIANCE PRODUCT BRIEF uugiven today s environment of sophisticated security threats, big data security intelligence solutions and regulatory compliance demands, the need for a log intelligence solution has become

More information

Protect the data that drives our customers business. Data Security. Imperva s mission is simple:

Protect the data that drives our customers business. Data Security. Imperva s mission is simple: The Imperva Story Who We Are Imperva is the global leader in data security. Thousands of the world s leading businesses, government organizations, and service providers rely on Imperva solutions to prevent

More information

QRadar Security Management Appliances

QRadar Security Management Appliances QRadar Security Management Appliances Q1 Labs QRadar network security management appliances and related software provide enterprises with an integrated framework that combines typically disparate network

More information

IBM Software InfoSphere Guardium. Planning a data security and auditing deployment for Hadoop

IBM Software InfoSphere Guardium. Planning a data security and auditing deployment for Hadoop Planning a data security and auditing deployment for Hadoop 2 1 2 3 4 5 6 Introduction Architecture Plan Implement Operationalize Conclusion Key requirements for detecting data breaches and addressing

More information

Scalability in Log Management

Scalability in Log Management Whitepaper Scalability in Log Management Research 010-021609-02 ArcSight, Inc. 5 Results Way, Cupertino, CA 95014, USA www.arcsight.com info@arcsight.com Corporate Headquarters: 1-888-415-ARST EMEA Headquarters:

More information

SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK. www.alienvault.com

SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK. www.alienvault.com SIEM FOR BEGINNERS EVERYTHING YOU WANTED TO KNOW ABOUT LOG MANAGEMENT BUT WERE AFRAID TO ASK www.alienvault.com A Rose By Any Other Name SLM/LMS, SIM, SEM, SEC, SIEM Although the industry has settled on

More information

SYSTEM BACKUP AND RESTORE (AlienVault USM 4.8+)

SYSTEM BACKUP AND RESTORE (AlienVault USM 4.8+) Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

NitroView Enterprise Security Manager (ESM), Enterprise Log Manager (ELM), & Receivers

NitroView Enterprise Security Manager (ESM), Enterprise Log Manager (ELM), & Receivers NitroView Enterprise Security Manager (ESM), Enterprise Log Manager (ELM), & Receivers The World's Fastest and Most Scalable SIEM Finally an enterprise-class security information and event management system

More information

Cisco Remote Management Services for Security

Cisco Remote Management Services for Security Cisco Remote Management Services for Security Innovation: Many Take Advantage of It, Some Strive for It, Cisco Delivers It. Cisco Remote Management Services (RMS) for Security provide around the clock

More information

BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports

BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports BUILDING A SECURITY OPERATION CENTER (SOC) ACI-BIT Vancouver, BC. Los Angeles World Airports Building a Security Operation Center Agenda: Auditing Your Network Environment Selecting Effective Security

More information

DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch

DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch What You Will Learn A demilitarized zone (DMZ) is a separate network located in the neutral zone between a private (inside)

More information

Passive Logging. Intrusion Detection System (IDS): Software that automates this process

Passive Logging. Intrusion Detection System (IDS): Software that automates this process Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion

More information

Device Integration: Citrix NetScaler

Device Integration: Citrix NetScaler Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat

More information

SonicWALL Global Management System Reporting Guide Standard Edition

SonicWALL Global Management System Reporting Guide Standard Edition SonicWALL Global Management System Reporting Guide Standard Edition Version 2.8 Copyright Information 2004 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software described

More information

McAfee Security Information Event Management (SIEM) Administration Course 101

McAfee Security Information Event Management (SIEM) Administration Course 101 McAfee Security Information Event Management (SIEM) Administration Course 101 Intel Security Education Services Administration Course The McAfee SIEM Administration course from McAfee Education Services

More information

Simplify Your Network Security with All-In-One Unified Threat Management

Simplify Your Network Security with All-In-One Unified Threat Management Singtel Business Product Factsheet Brochure Managed Defense Unified Services Management Simplify Your Network Security with All-In-One Unified Management Singtel Managed Unified Management (UTM) Services,

More information

Clavister InSight TM. Protecting Values

Clavister InSight TM. Protecting Values Clavister InSight TM Clavister SSP Security Services Platform firewall VPN termination intrusion prevention anti-virus anti-spam content filtering traffic shaping authentication Protecting Values & Enterprise-wide

More information

Panorama PANORAMA. Panorama provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls.

Panorama PANORAMA. Panorama provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls. provides centralized policy and device management over a network of Palo Alto Networks next-generation firewalls. View a graphical summary of the applications on the network, the respective users, and

More information

Best Practices & Deployment SurfControl Mobile Filter v 5.0.2.60

Best Practices & Deployment SurfControl Mobile Filter v 5.0.2.60 Best Practices & Deployment SurfControl Mobile Filter v 5.0.2.60 rev2.1, January 2006 Pre-Installation Guide Notice 2006 SurfControl. All rights reserved. SurfControl, SurfControl E-mail Filter, SurfControl

More information

Network Monitoring Comparison

Network Monitoring Comparison Network Monitoring Comparison vs Network Monitoring is essential for every network administrator. It determines how effective your IT team is at solving problems or even completely eliminating them. Even

More information

Find the needle in the security haystack

Find the needle in the security haystack Find the needle in the security haystack Gunnar Kristian Kopperud Principal Presales Consultant Security & Endpoint Management Technology Day Oslo 1 Find the needle in the security haystack Manually deep

More information

IBM Security QRadar SIEM & Fortinet FortiGate / FortiAnalyzer

IBM Security QRadar SIEM & Fortinet FortiGate / FortiAnalyzer IBM Security QRadar SIEM & Fortinet / FortiAnalyzer Introducing new functionality for IBM QRadar Security Intelligence Platform: integration with Fortinet s firewalls and logs forwarded by FortiAnalyzer.

More information

Discover Security That s Highly Intelligent.

Discover Security That s Highly Intelligent. Discover Security That s Highly Intelligent. AlienVault delivers everything you need to detect, defend against, & respond to today s threats in minutes. About AlienVault Founded in 2007 and headquartered

More information

DETECT AND RESPOND TO THREATS FROM THE DATA CENTER TO THE CLOUD

DETECT AND RESPOND TO THREATS FROM THE DATA CENTER TO THE CLOUD SOLUTION OVERVIEW: ALERT LOGIC THREAT MANAGER WITH ACTIVEWATCH DETECT AND RESPOND TO THREATS FROM THE DATA CENTER TO THE CLOUD Protecting your infrastructure requires you to detect threats, identify suspicious

More information

SANS Top 20 Critical Controls for Effective Cyber Defense

SANS Top 20 Critical Controls for Effective Cyber Defense WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a

More information

Forcepoint Stonesoft Management Center

Forcepoint Stonesoft Management Center Datasheet Forcepoint Stonesoft Management Center EFFICIENT, CENTRALIZED MANAGEMENT OF FORCEPOINT STONESOFT NEXT GENERATION FIREWALLS IN DISTRIBUTED ENTERPRISE ENVIRONMENTS FORCEPOINT STONESOFT MANAGEMENT

More information

AlienVault. Unified Security Management (USM) 4.8-5.x Initial Setup Guide

AlienVault. Unified Security Management (USM) 4.8-5.x Initial Setup Guide AlienVault Unified Security Management (USM) 4.8-5.x Initial Setup Guide Contents USM v4.8-5.x Initial Setup Guide Copyright AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault, AlienVault

More information

ALERT LOGIC LOG MANAGER & LOGREVIEW

ALERT LOGIC LOG MANAGER & LOGREVIEW SOLUTION OVERVIEW: ALERT LOGIC LOG MANAGER & LOGREVIEW CLOUD-POWERED LOG MANAGEMENT AS A SERVICE Simplify Security and Compliance Across All Your IT Assets. Log management is an infrastructure management

More information

Mucho Big Data y La Seguridad para cuándo?

Mucho Big Data y La Seguridad para cuándo? Mucho Big Data y La Seguridad para cuándo? Juan Carlos Vázquez Sales Systems Engineer, LTAM mayo 9, 2013 Agenda Business Drivers Big Security Data GTI Integration SIEM Architecture & Offering Why McAfee

More information

Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1

Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1 Application Discovery Manager User s Guide vcenter Application Discovery Manager 6.2.1 This document supports the version of each product listed and supports all subsequent versions until the document

More information

Managed Security Services for Data

Managed Security Services for Data A v a y a G l o b a l S e r v i c e s Managed Security Services for Data P r o a c t i v e l y M a n a g i n g Y o u r N e t w o r k S e c u r i t y 2 4 x 7 x 3 6 5 IP Telephony Contact Centers Unified

More information

A Prevention & Notification System By Using Firewall. Log Data. Pilan Lin

A Prevention & Notification System By Using Firewall. Log Data. Pilan Lin A Prevention & Notification System By Using Firewall Log Data By Pilan Lin 1 Table Of Content ABSTRACT... 3 1 INTRODUCTION... 4 2. Firewall Log data... 6 2.1 How to collect log data... 6 3. Prevention

More information

RSA Security Analytics Security Analytics System Overview

RSA Security Analytics Security Analytics System Overview RSA Security Analytics Security Analytics System Overview Copyright 2010-2015 RSA, the Security Division of EMC. All rights reserved. Trademarks RSA, the RSA Logo and EMC are either registered trademarks

More information

Strategic Anti-malware Monitoring with Nessus, PVS, & LCE

Strategic Anti-malware Monitoring with Nessus, PVS, & LCE Strategic Anti-malware Monitoring with Nessus, PVS, & LCE August 2, 2012 (Revision 2) Copyright 2002-2012 Tenable Network Security, Inc. Tenable Network Security, Nessus and ProfessionalFeed are registered

More information

Effective Threat Management. Building a complete lifecycle to manage enterprise threats.

Effective Threat Management. Building a complete lifecycle to manage enterprise threats. Effective Threat Management Building a complete lifecycle to manage enterprise threats. Threat Management Lifecycle Assimilation of Operational Security Disciplines into an Interdependent System of Proactive

More information

Configuring Security for FTP Traffic

Configuring Security for FTP Traffic 2 Configuring Security for FTP Traffic Securing FTP traffic Creating a security profile for FTP traffic Configuring a local traffic FTP profile Assigning an FTP security profile to a local traffic FTP

More information

Sourcefire Defense Center TM

Sourcefire Defense Center TM Sourcefire TM Sourcefire Capabilities Store up to 100,000,000 security & host events, including packet data Centralized policy & sensor management Centralized audit logging of configuration & security

More information

Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks

Decryption. Palo Alto Networks. PAN-OS Administrator s Guide Version 6.0. Copyright 2007-2015 Palo Alto Networks Decryption Palo Alto Networks PAN-OS Administrator s Guide Version 6.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us

More information

The Cisco Certified Network Associate (CCNA) course consists of semesters 1 to 4 of the Cisco Networking Academy Program.

The Cisco Certified Network Associate (CCNA) course consists of semesters 1 to 4 of the Cisco Networking Academy Program. CISCO CERTIFIED NETWORK ASSOCIATE (CCNA) TRAINING Objective: This training is aimed to give a foundation in and apprenticeship of networking to your Company's Computer Administrators and Support Staff.

More information

Symantec Security Information Manager 4.8 Release Notes

Symantec Security Information Manager 4.8 Release Notes Symantec Security Information Manager 4.8 Release Notes Symantec Security Information Manager 4.8 Release Notes The software described in this book is furnished under a license agreement and may be used

More information

Securing your IT infrastructure with SOC/NOC collaboration

Securing your IT infrastructure with SOC/NOC collaboration Technical white paper Securing your IT infrastructure with SOC/NOC collaboration Universal log management for IT operations Table of contents Executive summary 2 IT operations: Handle IT incidents and

More information

Extreme Networks Security Analytics G2 Risk Manager

Extreme Networks Security Analytics G2 Risk Manager DATA SHEET Extreme Networks Security Analytics G2 Risk Manager Proactively manage vulnerabilities and network device configuration to reduce risk, improve compliance HIGHLIGHTS Visualize current and potential

More information

Flow Publisher v1.0 Getting Started Guide. Get started with WhatsUp Flow Publisher.

Flow Publisher v1.0 Getting Started Guide. Get started with WhatsUp Flow Publisher. Flow Publisher v1.0 Getting Started Guide Get started with WhatsUp Flow Publisher. Contents CHAPTER 1 Welcome Welcome to Flow Publisher... 1 About Flow Publisher... 2 Deploying Deploying Flow Publisher...

More information

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..

More information

Observer Analysis Advantages

Observer Analysis Advantages In-Depth Analysis for Gigabit and 10 Gb Networks For enterprise management, gigabit and 10 Gb Ethernet networks mean high-speed communication, on-demand systems, and improved business functions. For enterprise

More information

SonicWALL Global Management System Reporting Guide Standard Edition

SonicWALL Global Management System Reporting Guide Standard Edition SonicWALL Global Management System Reporting Guide Standard Edition Version 2.9.4 Copyright Information 2005 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software described

More information

Using SolarWinds Log and Event Manager (LEM) Filters and Alerts

Using SolarWinds Log and Event Manager (LEM) Filters and Alerts Using SolarWinds Log and Event Manager (LEM) Filters and Alerts Introduction... 1 Definitions... 1 LEM Components and Architecture... 2 LEM Alerts A Peek Under the Hood... 3 Troubleshooting Agents and

More information

IBM QRadar Security Intelligence April 2013

IBM QRadar Security Intelligence April 2013 IBM QRadar Security Intelligence April 2013 1 2012 IBM Corporation Today s Challenges 2 Organizations Need an Intelligent View into Their Security Posture 3 What is Security Intelligence? Security Intelligence

More information

Unified network traffic monitoring for physical and VMware environments

Unified network traffic monitoring for physical and VMware environments Unified network traffic monitoring for physical and VMware environments Applications and servers hosted in a virtual environment have the same network monitoring requirements as applications and servers

More information

Minder. simplifying IT. All-in-one solution to monitor Network, Server, Application & Log Data

Minder. simplifying IT. All-in-one solution to monitor Network, Server, Application & Log Data Minder simplifying IT All-in-one solution to monitor Network, Server, Application & Log Data Simplify the Complexity of Managing Your IT Environment... To help you ensure the availability and performance

More information

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network

More information

Palo Alto Networks User-ID Services. Unified Visitor Management

Palo Alto Networks User-ID Services. Unified Visitor Management Palo Alto Networks User-ID Services Unified Visitor Management Copyright 2011 Aruba Networks, Inc. Aruba Networks trademarks include Airwave, Aruba Networks, Aruba Wireless Networks, the registered Aruba

More information

Configuration Example

Configuration Example Configuration Example Centralized Branch Office VPN Architecture (Hub & Spoke) Example configuration files created with WSM v11.10.1 Revised 7/24/2015 Use Case In this configuration example, an organization

More information

IBM SECURITY QRADAR INCIDENT FORENSICS

IBM SECURITY QRADAR INCIDENT FORENSICS IBM SECURITY QRADAR INCIDENT FORENSICS DELIVERING CLARITY TO CYBER SECURITY INVESTIGATIONS Gyenese Péter Channel Sales Leader, CEE IBM Security Systems 12014 IBM Corporation Harsh realities for many enterprise

More information

Ovation Security Center Data Sheet

Ovation Security Center Data Sheet Features Scans for vulnerabilities Discovers assets Deploys security patches transparently Allows only white-listed applications to run in workstations Provides virus protection for Ovation Windows workstations

More information

McAfee Application Control / Change Control Administration Intel Security Education Services Administration Course

McAfee Application Control / Change Control Administration Intel Security Education Services Administration Course McAfee Application Control / Change Control Administration Intel Security Education Services Administration Course The McAfee University Application Control / Change Control Administration course enables

More information

_Firewall. Palo Alto. How Logtrust works with Palo Alto Networks

_Firewall. Palo Alto. How Logtrust works with Palo Alto Networks _Firewall Palo Alto Networks is the next-generation firewalls that enhance your network security and enable any enterprises to look beyond IP addresses and packets. These innovative firewalls let you see

More information

Architecture Overview

Architecture Overview Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and

More information

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9

NETASQ & PCI DSS. Is NETASQ compatible with PCI DSS? NG Firewall version 9 NETASQ & PCI DSS Is NETASQ compatible with PCI DSS? We have often been asked this question. Unfortunately, even the best firewall is but an element in the process of PCI DSS certification. This document

More information

Discover & Investigate Advanced Threats. OVERVIEW

Discover & Investigate Advanced Threats. OVERVIEW Discover & Investigate Advanced Threats. OVERVIEW HIGHLIGHTS Introducing RSA Security Analytics, Providing: Security monitoring Incident investigation Compliance reporting Providing Big Data Security Analytics

More information

CALNET 3 Category 7 Network Based Management Security. Table of Contents

CALNET 3 Category 7 Network Based Management Security. Table of Contents State of California IFB STPD 12-001-B CALNET 3 Category 7 Network Based Security Table of Contents 7.2.1.4.a DDoS Detection and Mitigation Features... 1 7.2.2.3 Email Monitoring Service Features... 2 7.2.3.2

More information

Cisco Security Specialist 1 Introduction to Network Security p. 3 Need for Network Security p. 5 Security Threats p. 6 Security Concepts p.

Cisco Security Specialist 1 Introduction to Network Security p. 3 Need for Network Security p. 5 Security Threats p. 6 Security Concepts p. Foreword p. xxvi Introduction p. xxvii Audience p. xxvii Organization p. xxvii Cisco Security Specialist 1 p. xxx Introduction to Network Security p. 3 Need for Network Security p. 5 Security Threats p.

More information

Configuration Example

Configuration Example Configuration Example Use WatchGuard Application Control with Your Existing Firewall Example configuration files created with WSM v11.10.1 Revised 7/21/2015 Use Case An organization wants to block the

More information

Unified Threat Management, Managed Security, and the Cloud Services Model

Unified Threat Management, Managed Security, and the Cloud Services Model Unified Threat Management, Managed Security, and the Cloud Services Model Kurtis E. Minder CISSP Global Account Manager - Service Provider Group Fortinet, Inc. Introduction Kurtis E. Minder, Technical

More information

Configuration Example

Configuration Example Configuration Example Use Public IP Addresses Behind an XTM Device Example configuration files created with WSM v11.7.2 Revised 3/22/2013 Use Case There are several reasons to use publicly routable IP

More information

Lesson 5: Network perimeter security

Lesson 5: Network perimeter security Lesson 5: Network perimeter security Alejandro Ramos Fraile aramosf@sia.es Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide

More information