Configuring Security Insights
During the installation of Security Insights or after it's up and running, there are a few things you can do to customize the application for your domain.
Tune alert priorities
Each of the security alerts has been assigned a default priority. While our security experts have carefully considered the priorities for each alert, you can customize the priorities if you choose.
The valid priority values are:
| Priority | Description |
|---|---|
| 1 | Very High |
| 2 | High |
| 3 | Medium |
| 4 | Low |
| 5 | Info |
To do so, you’ll need to edit the AlertDescriptionLocal.csv lookup file, or upload it if it doesn't yet exist in the Devo domain where Security Insights is installed. Simply add one line for each alert for which you want to change the priority. Although there are other fields, to change the priority of an existing alert you only need to specify the alertName and the priority values in this file.
This lookup file is also used when you want to create custom security alerts so the alertCategory, alertTemplate, and alertDescription fields are necessary in that case. In the case of changing the priority of an existing alert, you can leave these undefined.
Here’s an example that sets the priority of secIntAnonymousConnection to 4 and SecIntPortIntoURL to 2.
|
|---|
Click here to download this example file and use it as a template. Once you have edited and saved this file, follow the instructions for uploading a lookup table. Be sure to set the data type for alertCategory and priority to integer and the rest to alphanumeric.
If the lookup file already exists, follow the instructions for editing an uploaded lookup. If the alert already appears in the existing lookup, you only need to edit the priority value. If it doesn’t appear in the lookup, add a new row where you enter the alertName and the new priority.
Create custom security alerts
Define the alert
While our security alerts address a wide range of security events, you can create your own alerts to meet the specific needs of your environment.
First, create the new alert as you would with any other alert with just two additional requirements:
- The Alert Name must start with SecInt. For example, SecIntMyCustomAlert.
- The Subcategory must be threats.
Optionally, if you want to use your custom alert to create an alert chain, you must include the fields you want to use to join it with the rest of alerts of the chain in the Message. Add them at the end of the message, preceded by ||. For example:
IP $sourceIP is creating connections to multiple IP addresses in the last 5 minutes||sourceIP;destIP
The fields added to use as joins for an alert chain must be named in a specific way in order to match the names of the fields in the default alerts defined by Devo.
This table lists the names accepted by Devo for the following default alert fields:
| Value in Devo default alerts | Values allowed |
|---|---|
| SOURCE_IP | sourceIP, sourceip, srcip |
| DESTINATION_IP | destinationIP, destinationip, destip, dstip |
| SOURCE_PORT | sourcePort, sourceport, srcport |
| DESTINATION_PORT | destinationPort, destinationport, destport, dstport |
| HOST | host, hostname |
| USER | user, username, userfield |
In the query below, we have changed the names of two fields (srcPort and dstPort) and given them one of the accepted names:
|
|---|
Fields containing IP addresses in ip data type must be converted to strings if you want to use them in a custom alert. The ip format is valid during the query creation, but you must change it to string after grouping your data, using the To string (str) operation. For example, see the following query
from firewall.all.trafficwhere ispublic(dstIp)select `lu/Threat-Fraud-by-IP/threat`(dstIp) as ThreatFraudwhere isnotnull(ThreatFraud)group every 5m by srcIp, dstIp, ThreatFraud, dstPortevery 5mselect count() as countwhere not ThreatFraud = "fraud",not ThreatFraud = ""select str(srcIp) as sourceIPselect str(dstIp) as destinationIPselect ThreatFraud as Threatwhere count > 10
Add the alert to Security Insights
Now you need to add the alert to Security Insights by including it in the AlertDescriptionLocal lookup file.
- If this lookup already exists, simply edit the lookup and add a new line for the alert. To see the list of lookups, go to Data Search and open the Lookup Management tab.
- If it doesn’t exist, you can download our template, delete the example data, and enter the values that describe your new alert. Then when you’ve saved the csv file containing your new alert, upload it to your Devo domain.
Here’s an example of a hypothetical custom alert called SecIntMyCustomAlert.
|
|---|
The possible values for the alertCategory field are:
| alertCategory | Description |
|---|---|
| 2 | Network: alerts from firewall, web, proxy. |
| 3 | Threats: alerts from firewall, web or proxy considered as threat. |
| 4 | Access: alerts from auth.all, box.win, or refered to user authentication. |
Create an alert chain
You can combine two or more of the alerts defined for the application to create an alert chain. An alert chain combines the criteria of multiple selected alerts. An alert chain is triggered when its component alerts all meet the established criteria. The queries that define the alerts in the chain are joined using a common field; that is to say, a field that is present in all of them. For example, you might create an alert chain to notify you when the same source IP address has triggered two separate alert types within a specified period of time.
See the instructions in the previous section to learn how to define custom alerts to be used to create an alert chain.
To create an alert chain:
- Click the lightning icon in the top right.
- You will see a list of all the alerts that are defined for the application. Select New alert chain to start the process.
- In step 1, you select the alerts you want to combine. Use the search to find specific alerts by the contents of their name or description. Click Next step when you're done.
In step 2, you set the join field, time window, alert chain details. These are the fields to complete:
Join field Select the common table field you want to use to join the alerts. If the alerts selected have no fields in common, the join field will be eventdate, which is present in every single data table. Time window Set the threshold of the alert chain. For example, choose 1h to check if the conditions of all the alerts added to the chain are met every 60 minutes. Priority Choose a priority for the alert chain between Info, Low, Medium, High and Critical. Alert name Enter a name for the alert chain. Alert chain names must always start with SecIntChain. Alert message A short message used to identify the alert condition. Alert description The full description of the alert chain conditions. You may use variables in this field. To reference a field value, write it preceeded by a dollar sign, like this: $sourceIP. Click Next step when you're done.
- Step 3 is simply a summary of the alert chain. Review and confirm the alert chain definition. You can select Show query to check the definition of the alert. Click Create alert to confirm the alert chain and create it.
Close the dialog an open it again to see the newly defined alert chain. You can create a new alert chain using this newly alert—there is no limitiation in creating new alert chains using other alert chains or common alerts.
Now you can go to Administration → Alerts Configuration and locate the new alert chain. Alert chains are automatically activated after you create them. However, note that they can be disabled, but not edited nor deleted. Following versions of the Security Insights application will make these options available.
Learn more about alerts and how to configure them reading the articles in the Configuring alerts section.
Create an IP address white list
You might have a list of IP addresses that generate activity on your network but that you know for sure do not pose threats. In this case you can create a white list so that any alerts generated by events involving these IP as the Source ID are immediately disregarded.
To implement the white list, we create a post-processing filter in the Alerts area of the web application. These filters are created from a triggered alert that appears in your Alert Dashboard. When defining the filter:
- Select Source IP under Basic Data and set it to the IP address you want on the white list. Add as many other Source IPs as you need.
- Select Delete as the Action. This will immediately delete the alert so that it doesn’t appear in the Alert History. No alert notifications will be sent.
Once saved, this filter will delete all alerts triggered by events where the Source IP is one of the IP addresses specified in the filter.
To modify the white list, it’s necessary to create a new filter with the updated list of Source IP addresses, then delete the existing filter. Post-filters cannot be edited.
Disable unused tabs (or re-enable them)
By default, the application contains nine different tabs; Overview, Threats, Network, DNS, Firewall, Proxy, Access, Web and IDS but Admin users can disable (or hide) any tabs that are not currently used in their deployment. For example, if your domain doesn’t have IDS data sources, it makes sense to disable the IDS tab.
To do this, we again use a special lookup file called tabsCustom.csv. This file has just two fields; tab is set to the tab name and enabled is set to either true or false.
|
|---|
Simply set a tab to false to hide it in the application. You can edit your lookup at any time to enable or disable tabs. Download the template that you can modify, then follow the instructions to upload it to your domain.