Configuring Security Insights

During the installation of Security Insights or after it's up and running, there are a few things you can do to customize the application for your domain.

Tune alert priorities

Each of the security alerts has been assigned a default priority. While our security experts have carefully considered the priorities for each alert, you can customize the priorities if you choose.

The valid priority values are:

To do so, you’ll need to edit the AlertDescriptionLocal.csv lookup file, or upload it if it doesn't yet exist in the Devo domain where Security Insights is installed. Simply add one line for each alert for which you want to change the priority. Although there are other fields, to change the priority of an existing alert you only need to specify the alertName and the priority values in this file.

Here’s an example that sets the priority of secIntAnonymousConnection to 4 and SecIntPortIntoURL to 2.

Click here to download this example file and use it as a template. Once you have edited and saved this file, follow the instructions for uploading a lookup table. Be sure to set the data type for alertCategory and priority to integer and the rest to alphanumeric.

If the lookup file already exists, follow the instructions for editing an uploaded lookup. If the alert already appears in the existing lookup, you only need to edit the priority value. If it doesn’t appear in the lookup, add a new row where you enter the alertName and the new priority.

Create custom security alerts

While our security alerts address a wide range of security events, you can create your own alerts to meet the specific needs of your environment.

First, create the new alert as you would with any other alert with just two additional requirements:

• The Alert Name must start with SecInt. For example, SecIntMyCustomAlert.
• The Subcategory must be threats.

• Optionally, if you want to use your custom alert to create an alert chain, you must include the fields you want to use to join it with the rest of alerts of the chain in the Message. Add them at the end of the message, preceded by ||. For example:

  IP $sourceIP is creating connections to multiple IP addresses in the last 5 minutes||sourceIP;destIP

Now you need to add the alert to Security Insights by including it in the AlertDescriptionLocal lookup file.

• If this lookup already exists, simply edit the lookup and add a new line for the alert. To see the list of lookups, go to Data Search and open the Lookup Management tab.
• If it doesn’t exist, you can download our template, delete the example data, and enter the values that describe your new alert. Then when you’ve saved the csv file containing your new alert, upload it to your Devo domain.

Here’s an example of a hypothetical custom alert called SecIntMyCustomAlert.

The possible values for the alertCategory field are:

Create an alert chain

You can combine two or more of the alerts defined for the application to create an alert chain. An alert chain combines the criteria of multiple selected alerts. An alert chain is triggered when its component alerts all meet the established criteria. The queries that define the alerts in the chain are joined using a common field; that is to say, a field that is present in all of them. For example, you might create an alert chain to notify you when the same source IP address has triggered two separate alert types within a specified period of time.

To create an alert chain:

1. Click the lightning icon in the top right. 
   
   
2. You will see a list of all the alerts that are defined for the application. Select New alert chain to start the process.
3. In step 1, you select the alerts you want to combine. Use the search to find specific alerts by the contents of their name or description. Click Next step when you're done.
   
   

4. In step 2, you set the join field, time window, alert chain details. These are the fields to complete:

   Join field	Select the common table field you want to use to join the alerts. If the alerts selected have no fields in common, the join field will be eventdate, which is present in every single data table.
   Time window	Set the threshold of the alert chain. For example, choose 1h to check if the conditions of all the alerts added to the chain are met every 60 minutes.
   Priority	Choose a priority for the alert chain between Info, Low, Medium, High and Critical.
   Alert name	Enter a name for the alert chain. Alert chain names must always start with SecIntChain.
   Alert message	A short message used to identify the alert condition.
   Alert description	The full description of the alert chain conditions. You may use variables in this field. To reference a field value, write it preceeded by a dollar sign, like this: $sourceIP.

   Click Next step when you're done.

5. Step 3 is simply a summary of the alert chain. Review and confirm the alert chain definition. You can select Show query to check the definition of the alert. Click Create alert to confirm the alert chain and create it.

Close the dialog an open it again to see the newly defined alert chain. You can create a new alert chain using this newly alert—there is no limitiation in creating new alert chains using other alert chains or common alerts.

Now you can go to Administration → Alerts Configuration and locate the new alert chain. Alert chains are automatically activated after you create them. However, note that they can be disabled, but not edited nor deleted. Following versions of the Security Insights application will make these options available. 

Learn more about alerts and how to configure them reading the articles in the Configuring alerts section.

Create an IP address white list

You might have a list of IP addresses that generate activity on your network but that you know for sure do not pose threats. In this case you can create a white list so that any alerts generated by events involving these IP as the Source ID are immediately disregarded.

To implement the white list, we create a post-processing filter in the Alerts area of the web application. These filters are created from a triggered alert that appears in your Alert Dashboard. When defining the filter:

• Select Source IP under Basic Data and set it to the IP address you want on the white list. Add as many other Source IPs as you need.
• Select Delete as the Action. This will immediately delete the alert so that it doesn’t appear in the Alert History. No alert notifications will be sent.

Once saved, this filter will delete all alerts triggered by events where the Source IP is one of the IP addresses specified in the filter.

To modify the white list, it’s necessary to create a new filter with the updated list of Source IP addresses, then delete the existing filter. Post-filters cannot be edited.

Disable unused tabs (or re-enable them)

By default, the application contains nine different tabs; Overview, Threats, Network, DNS, Firewall, Proxy, Access, Web and IDS but Admin users can disable (or hide) any tabs that are not currently used in their deployment. For example, if your domain doesn’t have IDS data sources, it makes sense to disable the IDS tab.

To do this, we again use a special lookup file called tabsCustom.csv. This file has just two fields; tab is set to the tab name and enabled is set to either true or false.

Simply set a tab to false to hide it in the application. You can edit your lookup at any time to enable or disable tabs. Download the template that you can modify, then follow the instructions to upload it to your domain.

Related articles

• Upload a lookup table
• Apply a filter for post-processing
• Installing Security Insights
• Navigating Security Insights