PRESET SECURITY POLICIES

SearchInform SIEM does not require intensive preliminary configuration. The solution incorporates predefined universal security policies. Preset security policies are based on a selection of common tasks that SearchInform clients have to tackle.

The principle of the system operation: taking practical tasks and solving them with SIEM. We have gathered opinions, practices, and needs of SearchInform clients and generated the policies. The system will be developed in the same way: when there are new sources of data, client will get a set of rules.

EXAMPLES OF PRESET POLICIES OF SEARCHINFORM SIEM FOR*:

• Active Directory domain controller

  • Temporary renaming of a user account
  • Password-guessing
  • Multiple accounts on a single computer
  • Password set by domain administrator
  • Obsolete passwords
  • Logon statistics
  • One account on multiple computers
  • Temporary enablement of account
  • Temporary addition of account to group
  • Obsolete AD account becoming active
  • Temporary assignment of AD permissions
  • Creation of temporary user accounts
  • Operations on accounts
  • Change of membership in critical user groups
  • Use of service accounts
  • User-initiated event log clearing
  • Audit policy change

• file operations

  • Temporary granting of file/folder permissions
  • Access to critical resources
  • Large number of users working with a file
  • Operations on specific file types
  • Statistics of changes of access rights to files/folders

• MS SQL

  • Temporary creation of MS SQL accounts.
  • Temporary enablement of MS SQL accounts
  • Statistic changes of access rights to MS SQL
  • Temporary inclusion of users in DB security role
  • SQL account password set by DB administrator
  • Temporary renaming of MS SQL account

• Kaspersky Antivirus

  • Software execution blocked by antivirus self-protection
  • Antivirus self-protection disabled
  • Antivirus protection components disabled
  • Failure to perform an administrative management task
  • Change of membership in the administrator group
  • Blocked and infected programs
  • Virus outbreak detected

• Exchange

  • Change of audit parameters of administrator
  • Change of management roles
  • Granting mail access
  • Owner of mail box was changed
  • Groups of management roles were changed
  • Access to mail box by another user

• user activity

  • Activity out of working hours
  • Long-absent user activity

• Syslog

  • Custom Syslog rules
  • Kernel events
  • User-level events
  • Mail systems events
  • System daemons events
  • Security and authorization events
  • Internal Syslog events
  • Line printer subsystems events
  • Network news subsystems events
  • UUCP subsystems events
  • Clock daemons events
  • FTP daemons events
  • NTP subsystems events
  • Log audit events
  • Log alert events
  • Scheduling daemon events
  • SearchInform DLP events

*relevant for SIEM 1.5.0.6 released on 30.03.2017