IDMEF, the universal format for security alerts, OW2con'16, Paris.
The constant growth of cybercrime requires that nations are organizing to unite their defense and protection. In the area of cyber-detection federation requires standardizing in two fields: - Communications between the various tools and security solutions in order to consolidate and correlate information simply, we will call this communication “intra” Security Centers. - Communications between different Security Centers Teams to share information on incidents, we will call this communications “inter” Security Centers (between CSIRT). Both recognized standards at IETF in this field are: - IDMEF (Intrusion Detection Message Exchange Format) – RFC 4765 - IODEF (Incident Object Description Exchange Format) – RFC 5070 These two standards are still relatively new and insufficiently deployed on a market still dominated by proprietary formats. Prelude is a SIEM (Security Information & Event Management). This is a security control tool that fully use IDMEF. Prelude collects and centralizes the company security information of to provide a central point of steering. Thanks to the analysis and correlation of logs, Prelude alerts in real time of intrusion attempts and threats on the network. Prelude offers several tools of investigation and reporting on your big data to identify the weak signals which may prefigure of advanced persistent threats (APT). Finally, Prelude has all the tools to help the operation to simplify operators’ work and risk management.
Recommandé
Contenu connexe
En vedette
En vedette (20)
Similaire à IDMEF, the universal format for security alerts, OW2con'16, Paris.
Similaire à IDMEF, the universal format for security alerts, OW2con'16, Paris. (20)
Plus de OW2
Plus de OW2 (20)
Dernier
Dernier (20)
IDMEF, the universal format for security alerts, OW2con'16, Paris.
- 1. SECEF DAY – 21/09/16 / 1/ 1/ 1 PRELUDE AND LIBPRELUDE THOMAS ANDREJAK – CS 22/09/2016
- 2. SECEF DAY – 21/09/16 / 2/ 2 WHO AM I âThomas ANDREJAK, 29 years old › Working at Communication & Systems (Paris) : https://www.c-s.fr › Technical manager of Prelude SIEM : https://www.prelude-siem.org › Expert in security of information systems âTalk : Prelude and LibPrelude › Prelude history › What is IDMEF › Where to find the library › How to use it › Live coding session
- 3. SECEF DAY – 21/09/16 / 3/ 3 PRELUDE SIEM
- 4. SECEF DAY – 21/09/16 / 4/ 4 WHAT IS PRELUDE ? â Prelude is an OpenSource SIEM and born in 1998 â Prelude has been based on IDMEF since the creation of the standard (2005) â Manipulation of IDMEF objects is done through two libraries in Prelude › LibPrelude : Manage IDMEF objects and transport of these objects › LibPreludeDB : Storage of IDMEF objects in a database â LibPrelude and LibPreludeDB are parts of Prelude OSS › https://www.prelude-siem.org â These libraries are released under the GPL v2 license
- 5. SECEF DAY – 21/09/16 / 5/ 5 WHAT IS IDMEF? âIDMEF (RFC 4765) › Intrusion Detection Message Exchange Format › Describes a technical security alerts format for information systems › Exchange of intrusion-related data between systems
- 6. SECEF DAY – 21/09/16 / 6/ 6 LIBPRELUDE - TECHNICAL IMPLEMENTATION â Library written in C (around 200k lines of code) â Available for the C++ and Python languages â Included in many IDS › Suricata › Snort › OSSEC › Etc. âIn the new RGI (French referential of interoperability) that has been released this year, IDMEF is in required state âWe continue to work with new security tools to help them to include the LibPrelude
- 7. SECEF DAY – 21/09/16 / 7/ 7 INTEGRATION âQuestions to ask yourself › What language does my program use? › Are both licenses compatible? › Where do I have to initialize my connector? › Where does my program handle reporting/notifications? § Usually around syslog functions › What information do I need to fill in IDMEF objects? › In which IDMEF fields do my data have to go ? âLibIDMEF tutorial › http://redmine.secef.net/projects/secef/wiki/How_to_use_LibIDMEF â“How to build a sensor” tutorial › http://redmine.secef.net/projects/secef/wiki/How_to_build_a_sensor
- 8. SECEF DAY – 21/09/16 / 8/ 8 AGENT CONTRIBUTION PROGRAM Development of a new agent for Prelude SIEM We are looking for many other security tools to become compatible with IDMEF ! Open partner program https://www.prelude-siem.org/projects/prelude/wiki/PreludeAgentContribution
- 9. SECEF DAY – 21/09/16 / 9/ 9 LIVE CODING SESSION Building an IDMEF sensor in 5 minutes
- 10. SECEF DAY – 21/09/16 / 10/ 10 QUESTIONS ?
- 11. SECEF DAY – 21/09/16 / 11/ 11 ANNEXE : BUILD AN IDMEF SENSOR IN 5 MINUTES