CEE Logging Standard: Today and Tomorrow

CEE Logging Standard: Today and Tomorrow Dr Anton Chuvakin Chief Logging Evangelist LogLogic, Inc

Outline ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Log Chaos I - Login? <122> Mar 4 09:23:15 localhost sshd[27577]: Accepted password for kyle from ::ffff:192.168.138.35 port 2895 ssh2 <13> Fri Mar 17 14:29:38 2006 680 Security SYSTEM User Failure Audit ENTERPRISE Account Logon Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account : POWERUSER Source Workstation: ENTERPRISE Error Code: 0xC000006A 4574 <57> Dec 25 00:04:32:%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user:yellowdog] [Source:10.4.2.11] [localport:23] at 20:55:40 UTC Fri Feb 28 2006 <18> Dec 17 15:45:57 10.14.93.7 ns5xp: NetScreen device_id=ns5xp system-warning-00515: Admin User netscreen has logged on via Telnet from 10.14.98.55:39073 (2002-12-17 15:50:53)

Log Chaos II - Accept? messages:Dec 16 17:28:49 10.14.93.7 ns5xp: NetScreen device_id=ns5xp system-notification-00257(traffic): start_time="2002-12-16 17:33:36" duration=5 policy_id=0 service=telnet proto=6 src zone=Trust dst zone=Untrust action=Permit sent=1170 rcvd=1500 src=10.14.94.221 dst=10.14.98.107 src_port=1384 dst_port=23 translated ip=10.14.93.7 port=1206 Mar 6 06:06:02 winonasu-pix %PIX-6-302013: Built outbound TCP connection 315210 596 for outside:172.196.9.206/1214 (172.196.9.206/1214) to inside:199.17.151.103/1438 (199.17.151.103/1438) Apr 6 06:06:02 Checkpoint NGX SRC=Any,DEST=ANY,Accept=nosubstitute,Do Not Log,Installspyware,lieonyourtaxes,orbetteryet,dontpaythem

Definitions ,[object Object],[object Object],[object Object],[object Object],[object Object]

Log Chaos ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Chaos2order: Why Logging Standards? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Various Logging Standards by Type ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Old, Dead and Vendor Log Standards ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What Killed’em ALL?  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What Worked? NIST 800-92 Guide to LM ,[object Object]

What is a Common Event Expression – CEE? CEE = Syntax + Vocabulary + Transport + Log Recommendations ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CEE Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CEE Current Status ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Key Area of CEE ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CEE Components ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

1. CEE on Log Transport ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

2. CEE on Log Format/Syntax ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

3. CEE on Log Taxonomy ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

4. CEE on Logging Recommendations ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Adoption, ADOPTION, A-D-O-P-T-I-O-N! ,[object Object],[object Object],[object Object],[object Object],[object Object]

Why CEE WILL Succeed!! ,[object Object],[object Object],[object Object],[object Object]

Conclusions: Future of CEE ,[object Object],[object Object],[object Object],[object Object],[object Object]

CEE + XDAS Together (Suggested!) ,[object Object],[object Object],[object Object],[object Object],[object Object]

Thanks for Attending the Presentation ,[object Object],[object Object],[object Object],[object Object],[object Object]

Backup and Example Slides from MITRE

CEE Example ,[object Object],[object Object],[object Object],Example Log Messages Transport - successful log transmission Syslog (each log message is transmitted in a single UDP packet usually over port 514/UDP) Syntax - details specific to event being logged Format (3) CEF message CEF:Version|Device Vendor|DeviceProduct|DeviceVersion|Signature ID|Name|Severity|Extension Extension is a meta item – it imposes a sytax extension to specify addition details - a data dictionary can enumerate these details Syntax - details specific to event being logged Format (1 and 2) month day time host program[pid]: message In CEE, each of these would be a possible syntax element, whose value and definition would be well defined by a Data Dictionary Data Dictionary needed to enumerate details associated with the event It needs to provide flexible syntax options by defining the elements and formats Ex: dst in the CEF event – defined by a dotted quad IPv4 address

CEE Example (Cont.) ,[object Object],[object Object],[object Object],Taxonomy – a reduced language set for consistent log messages Right now they are semantically similar – ok for humans – but not for computers

CEE Logging Standard: Today and Tomorrow

Recommandé

Recommandé

Contenu connexe

Similaire à CEE Logging Standard: Today and Tomorrow

Similaire à CEE Logging Standard: Today and Tomorrow (20)

Plus de Anton Chuvakin

Plus de Anton Chuvakin (20)

Dernier

Dernier (20)

CEE Logging Standard: Today and Tomorrow

Notes de l'éditeur