SOC 101: #1.1 Network Security Monitoring (NSM) Tools

noreply@blogger.com (venkat gugulothu) — Tue, 03 Apr 2018 10:24:00 +0000

Several types of network security monitoring (NSM) tools can collect the data that is available to a network security analyst for review. Each tool type has its own set of applicability. Data must be collected, managed, and presented to the analyst, so every SOC should have a suite of tools to provide these services.

When it comes to tool selection, there are many options. There is no standard set of SOC tools and each SOC selects its own suite of tools. There is some commonality between the types of tools that are used, but not in the specifics.

From the perspective of data, seven types of NSM data are discussed in this lesson, including session data, full packet capture, transaction data, extracted content, alert data, statistical data, and metadata. Correlation of events between the various NSM data sets is also important.

A network security analyst focuses on NSM data. Without NSM data, SOC analysts could not do their job. Without NSM tools, SOC analysts would not have NSM data. A NSM tool is software that collects, maintains, processes, and presents network security monitoring data.

Functions that are associated with a centralized syslog management system, which is an example of a NSM tool, include the following:

Receiving syslog messages from syslog clients that are distributed across the network, and storing those messages in a flat log file
Moving messages from the flat log file to a high-performance relational database
Processing low-level data in the relational database to produce higher-level information constructs
Presenting syslog data in the form of automated reports, dashboards, and real-time query responses

SOC tools can be difficult to categorize. The four functions that are mentioned for centralized syslog management may be implemented with a single monolithic tool or they may each be implemented with individual tools. Tools can work with multiple types of data or multiple data sources. For example, a single tool can be responsible for receiving syslog, NetFlow, and IPS alerts.

SOC tools can be commercial, open source, or homegrown. Commercial tools tend to be polished, full-featured, and offer vendor support, but tend to be expensive. Open source tools tend to be less polished, but are often very capable and freely distributable. Freely distributable does not mean free. Open source tools still require computer resources and they require administrator resources for installation, configuration, and maintenance. Technical support is often considered to be an advantage of commercial tools, but may also be available for open source tools. Some vendors use a model of open sourcing their products and profiting by offering contract-based technical support.

Homegrown tools are common in SOCs. Some organizations have full teams of programmers who provide sophisticated tool platforms. Also, simple scripts are written to provide functions that are missing in the greater tool set, or to provide an existing function in a more effective way. A SOC analyst will find scripting and programming skills as valuable assets.

There is no standard set of tools that is universally deployed in all SOCs. Each SOC will implement a unique suite of tools to meet its own unique set of requirements. In fact, individual analysts within a SOC may prefer different tools for analysis and presentation of NSM data. Also, the tool suite that is deployed in a SOC should be expected to evolve continuously over time.

Cyber Security X

SOC 101: #1.1 Network Security Monitoring (NSM) Tools