Monitoring Log Management and Alerting

Transcription

1 Monitoring Log Management and Alerting Services Description February / 24

2 Contents Monitoring Log Management and Alerting Centralized Management Centralized management : Multi Tenant Architecture : SLA Management Health and Performances monitoring Graphical Real Time Monitoring Console : Mapview Custom KPI monitoring Log Management and alerting Log Management Alerting Detailed Reports : / 24

3 1. Centralized Management 1.1. Centralized management : The UBIqube MSActivator tm is a powerful but very easy-to-use solution for provisioning management and monitoring for quick and cost effective delivery of security services on multi-vendor CPE devices (routers, firewall, UTM) deployed in multisite networks. The MSActivator tm profile based rule definition allows administrators to manage IPsec VPN, Firewall, IPS and content filtering policies on group of devices (please refer to the portfolio for more details on the managed services). 3 / 24

4 The MSActivator tm unified WEB portal centralized the provisioning, management and monitoring of the devices and services. All the events sent (syslog or snmp ) by the managed or monitored devices are collected, classified and analyzed centrally. SLA management statistics, security dashboards and detailed report are available online on the WEB portal to facilitate the troubleshooting throughout all the lifecycle of the devices and services. 4 / 24

5 1.2. Multi Tenant Architecture : The MSActivator tm unified WEB portal is built on a multi tenant architecture which supports VSOC (Vistual SOC) definition and customization Multiple accesses levels with Role based Access Control and delegation profile Per customer policies management Per VSOC configuration templates customization (Pattern files and PHP APIs) 5 / 24

6 6 / 24

7 2. SLA Management 2.1. Health and Performances monitoring Health and availability of the managed devices is monitored in real time. Devices key metrics monitored are : Access Availability Network Traffic CPU Load System Uptime VPN Tunnels History Network Delays : RTT (Round Trip Time) and TTL (Time To Live) The MSActivator tm maintains a one year history with one minute granularity of each metric. 7 / 24

8 8 / 24

9 Statistics can be compared between devices : 2.2. Graphical Real Time Monitoring Console : Mapview The status of the devices is also available on the graphical real time monitoring console called the mapview. 9 / 24

10 Detailed information on the asset and statistics are displayed when you click on a device. In addition to the status of the devices the mapview displays the profiles. 10 / 24

11 The Mapview allows management by graphically attaching or detaching devices to or from profiles Devices and VPN can be displays on a google map embedded in the Mapview : 11 / 24

12 2.3. Custom KPI monitoring In addition the security profiles, administrators can create monitoring profile gives the user the ability to create his own custom SNMP polling, configure threshold alerting and graphical rendering. Monitoring profile gives the user the ability to create his own custom SNMP polling, configure threshold alerting and graphical rendering. This allows the monitoring of any KPI (Key Performance Indicator) based on SNMP OID like the environmental conditions such as temperature and humidity etc. 12 / 24

13 Monitoring profiles can be easily imported and exported using XML. This API streamlines teh integration of the UBIqube with 3 rd party OSS tools or opensource monitoring tools. Below is an example of an XML file for monitoring teh packet loss : <?xml version="1.0" encoding="utf-8" standalone="yes"?> - <MonitoringProfile> <comment /> <name>packet Loss</name> - <graphrendererlist> - <datalist> <colorashexa>008080</colorashexa> - <data> <comment>number of input IP datagrams los</comment> <defaultpolling>false</defaultpolling> <filename>ipindiscards</filename> <id>0</id> <maxvalue>-1</maxvalue> <minvalue>0</minvalue> <name>ipindiscards</name> <oid> </oid> <pollingtype>67</pollingtype> <profileid>108</profileid> <threshold>10</threshold> <thresholdcomparator>71</thresholdcomparator> <thresholdfrequency>78</thresholdfrequency> </data> <horizontallabel>input</horizontallabel> <rendererid>0</rendererid> <snmppollingid>0</snmppollingid> </datalist> - <datalist> <colorashexa>ff6600</colorashexa> - <data> <comment>number of output IP datagrams lost</comment> <defaultpolling>false</defaultpolling> <filename>ipoutdiscards</filename> <id>1</id> <maxvalue>-1</maxvalue> <minvalue>0</minvalue> <name>ipoutdiscards</name> <oid> </oid> <pollingtype>67</pollingtype> <profileid>108</profileid> <threshold>10</threshold> <thresholdcomparator>71</thresholdcomparator> 13 / 24

14 <thresholdfrequency>78</thresholdfrequency> </data> <horizontallabel>output</horizontallabel> <rendererid>0</rendererid> <snmppollingid>1</snmppollingid> </datalist> <id>0</id> <name>packet Loss</name> <profileid>108</profileid> <vertivallabel>packet loss number</vertivallabel> </graphrendererlist> - <snmppollinglist> <comment>number of input IP datagrams los</comment> <defaultpolling>false</defaultpolling> <filename>ipindiscards</filename> <id>0</id> <maxvalue>-1</maxvalue> <minvalue>0</minvalue> <name>ipindiscards</name> <oid> </oid> <pollingtype>67</pollingtype> <profileid>108</profileid> <threshold>10</threshold> <thresholdcomparator>71</thresholdcomparator> <thresholdfrequency>68</thresholdfrequency> </snmppollinglist> - <snmppollinglist> <comment>number of output IP datagrams lost</comment> <defaultpolling>false</defaultpolling> <filename>ipoutdiscards</filename> <id>1</id> <maxvalue>-1</maxvalue> <minvalue>0</minvalue> <name>ipoutdiscards</name> <oid> </oid> <pollingtype>67</pollingtype> <profileid>108</profileid> <threshold>10</threshold> <thresholdcomparator>71</thresholdcomparator> <thresholdfrequency>68</thresholdfrequency> </snmppollinglist> </MonitoringProfile> 14 / 24

15 3. Log Management and alerting 3.1. Log Management The MSActivator tm centralizes all the events (Syslog or SNMP) sent by the managed or monitored devices. Events are available online via the WEB portal for 30 days. Then they are archived securely using a tamper proof solution complaint to Sarbannes Oxley (SOX) PCI or HIPPA recommendations. The security dashboards available on the WEB portal provides event reporting overview with search capabilities. This multiple entry table includes for each event category (IPS, Firewall, Anti Virus, URL Filtering, Anti Spam, Alerts and logs) : Site top 5 of the month/week : the top 5 of the most attacked sites giving the number of event and the associated percentage Alert top 5 of the month/week : the top 5 of the most received alerts giving the number of occurrences and the associated percentage Historical performance charts (day, week, month, year) 15 / 24

16 The log analysis engine computes the security dashboard and provides for each managed site a human readable monthly/weekly summary reports. Logs are displayed using different colours and icons depending on the severity level. 16 / 24

17 17 / 24

18 The summary reports aggregate every minute the events on a per day basis. Reports can be filtered per category or severity and events can be search by pattern. Detailed views are available on a per event basis. This page displays all the events in raw format Alerting s Alarms can be sent : To inform of a link or device outage To alert on the reception of a security event flagged as an Alarm one 18 / 24

19 To alert when a threshold is triggered s alerts are sent, on a per site basis, to the site contact and to the subscriber contact and copy to the SOC support address. Each field can contains multiple addresses eg : [email protected]; [email protected]. The mail alert service is configurable at the site level on the second page of the site creation or modification processes: Proactive continuous (24x7) monitoring and alerting Health and availability of the managed devices is monitored by the VSOC real time monitoring console (RTMC). A reachable device appears in green colour on the VSOC console. If the connectivity is lost the device appears in orange colour during 5 minutes. After 5 minutes if the reachability is still down the device appears in red colour and an alert is automatically sent. 19 / 24

20 This link or device outage, detected by the SOC, is called the Host Down event. An Host Up event is generated when a device connectivity is up again and an informational is sent. Early Warning of threat identification and detection alerts can also be sent upon identification and detection of predefined events. The VSOC console displays summary human readable events reports. Actions can be specified on a par event per site basis. Actions can be either to discard the event because it is a false positive one or to generate an alert. Alarms are summarized by date and the WEB interface provide alarm filtering by category (Firewall, IPS, Anti Virus, AntiSpam, URL Filtering, log) severity or by reference. 20 / 24

21 As soon as an event with the alerting flag set is received by the SOC Event Tracker, a mail is sent. To avoid mail flooding a maximum of one Alerts per day per alert is sent. Threshold Alerting 21 / 24

22 Monitoring profile gives the user the ability to create his own custom SNMP polling, to associate them to alerting threshold and graphical rendering. Threshold definition is used to trigger mail alerting to the user. The alert frequency can be configure per threshold from once to one per day, one per hour and even one per minute Detailed Reports : The MSActivator tm console provides detailed reports, in PDF format, for security events (Firewall, IDS/IPS, Anti Virus, Anti Spam, URL filtering, proxy) which occurred on a device. This service (detailed reporting) is optional and can be activated on a per device basis. 22 / 24

23 These PDF reports are generated on daily and monthly basis. The screenshots below give some examples of the monthly PDF report generated for a UTM device : 23 / 24

24 24 / 24