ArcSight Tips - Rule Actions Order

Have you ever wondered why ArcSight put those little buttons in rule actions?!



This is not accidental and they have a subtle purpose. Only a real-time example can clarify why they are needed and how much they matter.

Let's say we have events coming in the ESM at a high rate, and we have a Use Case that basically uses 2 rules and 2 active lists to get what we needed.

R1 evaluates base events and if NotInAL2 then actions by adding an entry in AL1

R2 evaluates against conditons DeviceEventClassID=activelist:103 & DCN1>=10 and if they match, then actions by removing from first list and add in second one.


And this is where the order counts. Picture above displays the right order. Let's think for a second what would be the implications if it was the the other way around. If we were to first choose to add to AL2 then to remove from AL1, what happens is in matter of miliseconds in the Correlation Engine although it may seem the entry was added to AL2 and that won't trigger in R1, the count (DCN1) is still incremented to 11, 12... thus making R2 to trigger multiple times. However, even if we cannot prevent that in the second approach, it won't have a huge impact on the outcome of our security scenario, that's because the DCN1 can still be incremented many times (after its removal from AL1) up until it is added to AL2 in action no.2 (picture again).
This would not be possible without existence of "MoveUp" and "MoveDown" in Actions Tab.

Comments

Post a Comment

Popular posts from this blog

Contactless Payment Card - A big security risk

Have you ever used a contactless card to pay for goods up to 20 gbp at a local store? Well, this is very convenient, let's face it, that's because you're simply touching the screen and make the payment, is that easy. But because you're not using a PIN (in a form of biometrics) or similar, there's a big security risk involved. And you know what several banks have done to avoid any dispute on that, they don't issue any receipt for the transaction, therefore no proof. In my opinion this is BAD, really BAD, I've heard they are going to lift this limit as soon as it will become generally available. Since banks are now sending contactless cards by default, the risk is there, and rather than update the security on the system or come up with other ways of securing the POS's and the cards (like fingerprint in Apple Pay), they would rather prefer current approach which is not great, I don't even understand how it got approved by Government or Financial Con
Read more

Rooting pentru HTC Desire HD (Aria)

Image
Satisfacția pe care o încerci atunci când îți reușește instalarea și configurarea unui ROM special creat pentru telefonul tău (altul decât cel oficial) este mare. Aproape la fel de mare ca atunci când am reușit instalarea pe notebook-ul soției, model HP 2510p a IOS-ului atât de prețios al lui Apple. Sătul să tot aștept după HTC să lanseze un amărât de update pentru sistemul de operare, care de altfel nu le aparține și care a ajuns la versiunea 2.3 de mai bine de 6 luni, însă pentru care HTC trebuie să modifice majoritatea aplicațiilor create in-house (care fie vorba între noi nu sunt chiar atât de bune pe cât se laudă) și trebuie să își vândă și noul model de telefon înainte de a face vreun „favor” actualilor clienți, m-am hotărât să fac „ rooting ” și să instalez ultima versiune de ROM Cyanogenmod 7 , despre care (pe bună dreptate) se spune că este cea mai stabilă distribuție pentru modelul meu de telefon. Rooting e un procedeu asemănător Jailbreak-ului pentru IOS-ul lui Apple, prin
Read more

Despre contestarea amenzilor RATB

In cele ce urmeaza va fi prezentata modalitatea in care se rezolva in prezent contestatiile amenziilor RATB. Noul regulament RATB prevede ca in cazul in care unui calator i se solicita prezentarea actelor la control si acesta nu le are la indemana, i se va intocmi un proces verbal de amenda, care poate fi contestat numai la judecatoria sectorului din raza zonei in care a avut loc evenimentul. Asta inseamna ca daca esti prins fara abonament, desi ai unul valid pe care l-ai uitat insa acasa (din motive variate si absolut normale), primesti un proces verbal de constatare, cu antet din partea RATB - Serviciul Comercial-Marketing (asta e chiar funny, tinand cont ca e completat si inmanat de agentul de control). In cazul in care amenda nu este platita pe loc, in termen de 15 zile se primeste Instiintarea de plata din partea aceluiasi RATB - Serviciu Comercial-Marketing. Impotriva acestei instiintari se poate face apoi plangere la judecatoria pe raza careia s-a savarsit contraventia. Urmeaza
Read more