How to send s triggered by events

Size: px

Start display at page:

Download "How to send emails triggered by events"

Bartholomew Warner
8 years ago
Views:

2 AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat Exchange, AlienVault OTX Reputation Monitor, AlienVault OTX Reputation Monitor Alert, AlienVault OSSIM and OSSIM are trademarks or service marks of AlienVault.

AlienVault OTX Reputation Monitor, AlienVault OTX Reputation Monitor

3 CONTENTS 1. INTRODUCTION CONCEPTS REQUIREMENTS HOW TO RECEIVE AN WHEN A NORMAL EVENT OCCURS HOW TO RECEIVE AN WHEN A DIRECTIVE EVENT OCCURS DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 3 of 17

HOW TO RECEIVE AN EMAIL WHEN A DIRECTIVE EVENT OCCURS.

4 1. INTRODUCTION This document describes how AlienVault USM sends s that include alerts previously defined. These alerts are events that arrive to the user through an and the events always meet the requirements defined in a created policy. 2. CONCEPTS In AlienVault, one normalized log file entry corresponds to a single Event. There are 2 types of events: normal event and directive event. Normal events. Events generated by external Data Sources. Directive events. Events generated by the AlienVault Server. Policy. A set of rules defined by a user to specify the behavior of events. 3. REQUIREMENTS The following requirements are necessary for receiving s when an event occurs: 1. Create a new policy. 2. Select or create a new DS Group. 3. Create an action. 4. HOW TO RECEIVE AN WHEN A NORMAL EVENT OCCURS 1. Choose Configuration > Threat Intelligence : 2. This window includes 2 parts. The upper part Default Policy Group refers to normal events and the bottom part Policies for events generated in server refers to directive events. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 4 of 17

CONCEPTS In AlienVault, one normalized log file entry corresponds to a single Event. There are 2 types of events: normal event and directive event. Normal events.

5 3. Click on New to create a new policy and enter a policy rule name. Then, enter the conditions and the consequences. When you click on a condition or on a consequence, the tab that corresponds to it will be opened. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 5 of 17

When you click on a condition or on a consequence, the tab that

6 4. Select one or more DS Group or insert a new one if it is not yet created. Remove the mark ( ) on ANY to have the possibility of selecting specific DS Groups. A DS Group can be created from Configuration > Threat Intelligence > Data Source or clicking on INSERT NEW DS GROUP?. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 6 of 17

A DS Group can be created from Configuration > Threat Intelligence > Data Source or

7 It is recommended to define a suitable policy in order to avoid a large number of s. It can happen that a DS Group cannot be selected, as it is displayed in the image: DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 7 of 17

8 This case happens when a DS Group includes normal events and directive events. That DS Group cannot be selected and displays this icon ( ). 5. Click on Actions and insert a new action: DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 8 of 17

Configuration > Threat Intelligence > Actions.

11 8. Select the policy and click on Reload Policies to add the created policy. Once this button is clicked, the s begin to be sent. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 11 of 17

Once this button is clicked, the emails begin to be

12 Check the Spam filter if there are no s in your mailbox. 5. HOW TO RECEIVE AN WHEN A DIRECTIVE EVENT OCCURS 1. Choose Configuration > Threat Intelligence : 2. This window includes 2 parts. The upper part Default Policy Group refers to normal events and the bottom part Policies for events generated in server refers to directive events. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 12 of 17

13 3. Click on New to create a new policy and enter a policy rule name. Then, enter the Event Type (DS Group) and the consequences. When you click on the conditions or on consequences, the tab that corresponds to it will be opened. 4. Select one or more DS Group or insert a new one if is not yet created. A DS Group can be created from Configuration > Threat Intelligence > Data Source or clicking on INSERT NEW DS GROUP?. Make sure that only Directive events have been selected for a DS Group. If not, this new DS Group would not appear in the selector. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 13 of 17

Select one or more DS Group or insert a new one if is not yet created.

14 It is recommended to define a suitable policy in order to avoid a large number of s. 5. Click on Actions and insert a new action by clicking on INSERT NEW ACTION?. An action can be also created from Configuration > Threat Intelligence > Actions. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 14 of 17

Click on Actions and insert a new action by clicking on INSERT NEW ACTION?

16 7. Click on UPDATE POLICY. 8. Click on Reload Policies to add the created policy. Once this button is clicked, the s begin to be sent. DC Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 16 of 17

Device Integration: Checkpoint Firewall-1

Device Integration: Checkpoint Firewall-1 Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat