Integrate Kaspersky Security Center

Transcription

1 Integrate Kaspersky Security Center EventTracker Enterprise Publication Date: Nov.15, 2016 EventTracker 8815 Center Park Drive Columbia MD

2 About this Guide This guide will facilitate a Kaspersky Security Center user to send logs to EventTracker Enterprise. Scope The configurations detailed in this guide are consistent with EventTracker Enterprise 7.x or later and Kaspersky Security Center 10. Audience Administrators who want to monitor Kaspersky Security Center using EventTracker Enterprise. The information contained in this document represents the current view of Prism Microsystems Inc. on the issues discussed as of the date of publication. Because Prism Microsystems must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Prism Microsystems, and Prism Microsystems cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. Prism Microsystems MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from Prism, as long as its content is unaltered, nothing is added to the content and credit to Prism is provided. Prism Microsystems may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Prism Microsystems, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred Prism Microsystems Corporation. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1

3 Table of Contents About this Guide... 1 Scope... 1 Audience... 1 Introduction... 3 Pre-requisites... 3 How to enable Kaspersky Event Logs and Send logs to EventTracker?... 3 EventTracker Knowledge Pack Categories Alerts Reports Importing Kaspersky Security Center knowledge pack into EventTracker Category Alerts Tokens Flex Reports Token Templates Verifying Kaspersky Security Center knowledge pack in EventTracker Categories Alerts Tokens Reports Token Template Create Flex Dashboards in EventTracker Schedule Reports Create Dashlets Sample Dashboards

4 Introduction Kaspersky Lab offers consumer security products, such as anti-virus, anti-malware and firewall applications, in addition to security systems designed for small business, corporations and large enterprises. Corporate solutions include protection for workstations, file servers, mail servers, payment gateways, banking servers, mobile devices, and internet gateways managed through a centralized Administration Kit. These applications are also available in bundled security suites scaled to fit the requirements of organizations of varying sizes. Pre-requisites EventTracker 7.x or later should be installed. EventTracker Agent to be installed on Kaspersky Security Center administrative server. How to enable Kaspersky Event Logs and Send logs to EventTracker? Step 1: Open the console of Kaspersky Security Center. Step 2: Right click on the Administrative server. Step 3: Select Properties. Step 4: Click on the Events. Figure 1 3

5 Figure 2 Step 5: Select info of the Event Type for which you want the logs to be forwarded and click on the Properties button. Figure 3 Step 6: Enable In the OS event log on Administration Server. 4

6 Step 7: Click OK twice. Figure 4 NOTE: In order to forward Kaspersky agent logs to Kaspersky manager a policy must be created. In case a policy has been created, there is no need to follow the below steps. If in case the policy has not been created, please follow the below mentioned steps: Step 8: Click Managed computers and select Policies > Create a Policy. 5

7 Figure 5 Step 9: Enter the name of the group policy for the application and click Next. Figure 6 6

8 Step 10: Select the application name and click Next. Step 11: Click Next. Figure 7 7

9 Step 12: Click Next. Figure 8 8

10 Figure 9 Step 13: Check the radio button I accept the terms of participation in Kaspersky security network and click Next. 9

11 Step 14: Click Settings Figure 10 Figure 11 10

12 Step 15: Enable all Save in Windows Event Log. Step 16: Click Next Figure 12 Figure 13 11

13 Step 17: Enter credentials and click Next. Figure 14 Step 18: Enable Active Policy and click Finish. Figure 15 12

14 Step 19: A policy will be created for client machine. Figure 16 Step 20: Open Event Viewer Expand Event Viewer > Kaspersky Event Log. You will see the list of events in the right frame. 13

15 Figure 17 Step 21: Deploy EventTracker Agent in Kaspersky Administrative Server. Please follow the steps mentioned in How to Install EventTracker and Change Audit. EventTracker Knowledge Pack Once Kaspersky Security Center events are enabled and Kaspersky Security Center events are received in EventTracker, Alerts and Reports can be configured in EventTracker. The following Knowledge Packs are available in EventTracker to support Kaspersky Security Center monitoring. 14

16 Categories Kaspersky Security Center: Report management This category provides information related to report management when a report is added, deleted or modified on Kaspersky Security Center. Kaspersky Security Center: Task management This category provides information related to task management when a task is added, deleted or modified on Kaspersky Security Center. Kaspersky Security Center: Policy management This category provides information related to policy management when a policy is added, deleted or modified on Kaspersky Security Center. Kaspersky Security Center: Group task management This category provides information related to group task management when a group task is added, deleted or modified on Kaspersky Security Center. Kaspersky Security Center: Administrative group management This category provides information related to administrative group management when an administrative group is added, deleted or modified on Kaspersky Security Center. Kaspersky Security Center: Malicious object scan status This category provides information related to malicious object which has been detected and untreated on Kaspersky Security Center. Kaspersky Security Center: Application privilege management: This category provides information related to applications that have been added to the trusted group on Kaspersky Security Center. Kaspersky Security Center: Application settings change- This category provides information related to applications where their settings are changed on Kaspersky Security Center. Kaspersky Security Center: Blocked files- This category provides information related to files which are being blocked by Kaspersky Security Center. Kaspersky Security Center: Device Control- This category provides information related to devices which have been blocked when inserted into the system of Kaspersky Security Center. 15

17 Kaspersky Security Center: Malware detected- This category provides information related to malwares which have been detected in the system of Kaspersky Security Center. Kaspersky Security Center: Object quarantine- This category provides information related to malware objects which are added into quarantine list in Kaspersky Security Center. Kaspersky Security Center: Task management- This category provides information related to task management of Kaspersky Security Center. Kaspersky Security Center: Vulnerability detected- This category provides information related to vulnerability which has been detected in Kaspersky Security Center. Alerts Kaspersky Security Center: Policy Changed- This alert is generated when a policy has been changed in the Kaspersky Security Center. Kaspersky Security Center: Malicious object detected- This alert is generated when a malicious object has been detected in Kaspersky Security Center. Kaspersky Security Center: Blocked files- This alert is generated when a user tries to access any of the blocked files in Kaspersky Security Center. Kaspersky Security Center: Malware detected- This generated when one of the file or web malware has been detected in Kaspersky Security Center. Reports Kaspersky Security Center- Application settings change: This report provides information related to application settings where there are certain changes done in the application setting, which gives path, user name, and component etc. Logs considered Event type: Application settings changed Application\Name: Kaspersky Security Center 10 for Windows Application\Path: c:\program files (x86)\kaspersky lab\kaspersky Security Center 10 for windows sp1\ User: TOONS\gorge, TOONS\Michel (Active user) Scan settings: Heuristic Analysis: Medium scan, Action on threat detection: Block message Component: IM Anti-Virus 16

18 Sample Report Figure 18 Kaspersky Security Center- Device Control: This report provides information related to device where the device has been blocked or allowed. Logs considered PRI-WIN8-WST05 [Monday, August 29, :37:34 PM (GMT+05:-30)] (Device Control): Event type: Operation with the device prohibited Device\Device category: Device Device\Device type/bus type: Removable drives Device\Device ID: USBSTOR\DISK&VEN_HP&PROD_V215B&REV_1100\ &0 Device\Device VID and PID: VEN_HP&PROD_V215B User: TOONS\Michel (Not defined) Result\Decision: Block Result\Operation: Disconnect Sample Report Figure 19 Kaspersky Security Center- Web malware detected: This report provides information related to malware detected in web for which user tries to access an unidentified object. Logs considered PRI-WIN8-WST05 [Monday, August 29, :30:31 PM (GMT+05:-30)] (Web Anti-Virus): Result: Detected: EICAR-Test-File User: TOONS\Michel (Active user) Object: 17

19 Sample Report Figure 20 Kaspersky Security Center-Blocked files: This report provides information related to files which are blocked when the user tries to access the blocked files. Logs considered R1S4-VM2 [Monday, July 25, :47:05 PM (GMT+05:-30)] (Protection): Event type: Action blocked by Self-Defense Application\Name: Windows Explorer Application\Path: c:\windows\ Application\Process ID: User: TOONS\ditto (Active user) Component: Protection Result\Description: Blocked Action: Open Object: C:\Program Files (x86)\kaspersky Lab\Kaspersky Security Center 10 for Windows SP1\avp.exe Object\Type: Process Object\Path: c:\windows\ Object\Name: avp.exe Sample Report Figure 21 Kaspersky Security Center-File malware detected: This report provides information related to malware detected in file for which user tries to access an unidentified object. Logs considered R1S4-VM4 [Tuesday, July 26, :25:17 PM (GMT+05:-30)] (File Anti-Virus): Result: EICAR-Test-File User: TOONS\Michel (Initiator) Object: C:\users\Michel\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9lnmoz5x\eicar[1].com Detected: 18

20 Sample Report Figure 22 Kaspersky Security Center-Object quarantine: This report provides information related to object quarantine that is malware object, stored in quarantined list. Logs considered R1S4-VM2 [Monday, July 25, :48:33 PM (GMT+05:-30)] (File Anti-Virus): Event type: copy of the object was created Application\Name: Firefox Application\Path: c:\program files (x86)\mozilla firefox\ Application\Process ID: User: TOONS\Michel (Active user) Component: File Anti-Virus Result\Description: Backup created Result\Type: Virus Result\Name: EICAR-Test-File Result\Threat level: High Result\Precision: Exactly Object: C:\users\Michel\downloads\eicar.com Object\Type: File Object\Path: C:\users\Michel\downloads\ Object\Name: eicar.com A backup Sample Report Figure 23 Kaspersky Security Center-Task management: This report provides information related to task management where the task has been started or stop. 19

21 Logs considered R1S4-VM4 [Tuesday, July 26, :00:04 PM (GMT+05:-30)] (Critical Areas Scan): Event type: Task started Application\Name: Kaspersky Security Center 10 for Windows Application\Path: c:\program files (x86)\kaspersky lab\kaspersky Security Center 10 for windows sp1\ User: NT AUTHORITY\SYSTEM (Initiator) Scan settings: Security level: Recommended, Heuristic Analysis: Deep scan, Action on threat detection: Select action automatically Component: Custom Scan Result\Description: Task started Object: Critical Areas Scan Object\Type: Subsystem Object\Name: Critical Areas Scan Sample Report Figure 24 Kaspersky Security Center-Vulnerability detected: This report provides information related to vulnerability where the vulnerability has been detected based on their description, name, status etc. Logs considered PRI-WIN8-WST05 [Monday, October 3, :33:26 AM (GMT-08:00)] (<Product>): Event type: Vulnerability detected Vulnerability\Vulnerability status: Open Vulnerability\Vulnerability name: KLA10872 Vulnerability\Vulnerability description: Vulnerability source\vendor: Microsoft Vulnerability source\application: Microsoft Product Vulnerability source\source object: c871e278-64b8-43b5-a1b2-619a0eb154d1 User: TOONS\Michel (Active user) <EventData><Data>PRI-WIN8-WST05 [Monday, October 3, :33:26 AM (GMT-08:00)] (<Product>): Event type: Vulnerability detected Vulnerability\Vulnerability status: Open Vulnerability\Vulnerability name: KLA10872 Vulnerability\Vulnerability description: Vulnerability source\vendor: Microsoft 20

22 Vulnerability source\application: Microsoft Product Vulnerability source\source object: c871e278-64b8-43b5-a1b2-619a0eb154d1 User: TOONS\Michel (Active user) </Data></EventData> Sample Report Figure 25 Kaspersky Security Center- Report management: This report provides information related to report management that is when a user tries to generate or modify or delete a report. Logs considered ESXWIN2K12R2VM2 [Friday, March 25, :20:51 PM (GMT+05:-30)]: Report "virus detected" was added by user "johnson" ESXWIN2K12R2VM2 [Friday, March 25, :20:51 PM (GMT+05:-30)]: Report "error report" was deleted by user "Barbara" ESXWIN2K12R2VM2 [Friday, March 25, :20:51 PM (GMT+05:-30)]: Report "virus detected" was modified by user "johnson" ESXWIN2K12R2VM2 [Friday, March 25, :20:51 PM (GMT+05:-30)]: Report "Viruses report" was generated by user "Barbara" Sample Report Figure 26 Kaspersky Security Center- Task management: This report provides information related to task management that is when a user tries to generate or modify or delete a task. 21

23 Logs considered ESXWIN2K12R2VM2 [Friday, March 25, :18:17 PM (GMT+05:-30)]: Task for specific computers "Deploy Kaspersky Security Center Network Agent ( ) (4)" has been deleted by user "rachael". ESXWIN2K12R2VM2 [Friday, March 25, :18:16 PM (GMT+05:-30)]: Task for specific computers "Deploy Kaspersky Security Center Network Agent ( ) (4)" has been modified by user "patrisha". ESXWIN2K12R2VM2 [Friday, March 25, :18:16 PM (GMT+05:-30)]: Task for specific computers "Deploy Kaspersky Security Center Network Agent ( ) (4)" has been generated by user "patrisha". Sample Report Figure 27 Kaspersky Security Center- Policy management: This report provides information related to policy management that is when a user tries to delete or modify or add a policy. Logs considered ESXWIN2K12R2VM2 [Friday, March 25, :16:01 PM (GMT+05:-30)]: Policy "Kaspersky Security Center Network Agent" has been modified by user "michael" ESXWIN2K12R2VM2 [Friday, March 25, :16:01 PM (GMT+05:-30)]: Policy "Kaspersky Security Center Network Agent" has been added by user "michael" ESXWIN2K12R2VM2 [Friday, March 25, :16:01 PM (GMT+05:-30)]: Policy "Kaspersky Security Center Network Agent" has been deleted by user "michael" 22

24 Sample Report Figure 28 Kaspersky Security Center- Group task management: This report provides information related to group task management that is when a user tries to start or delete or add a group task. Logs considered ESXWIN2K12R2VM2 [Friday, March 25, :18:16 PM (GMT+05:-30)]: Group task "Virus Scan" has been started by user "michael" ESXWIN2K12R2VM2 [Friday, March 25, :18:16 PM (GMT+05:-30)]: Group task "Automatic installation - Kaspersky Security Center Network Agent ( )" has been added by user "michael" ESXWIN2K12R2VM2 [Friday, March 25, :18:16 PM (GMT+05:-30)]: Group task "Automatic installation - Kaspersky Security Center Network Agent ( )" has been deleted by user "michael" Sample Report Figure 29 Kaspersky Security Center - Administrative group management: This report provides information related to administrative group management that is when a user tries to generate or modify or delete administrative group. 23

25 Logs considered ESXWIN2K12R2VM2 [Friday, March 25, :48:00 PM (GMT+05:-30)]: Computer "ESXWIN7VM3" has been added from administration group "TOONS" by user "rachael" ESXWIN2K12R2VM2 [Friday, March 25, :48:00 PM (GMT+05:-30)]: Computer "ESXWIN7VM3" has been deleted to administration group "Managed computers" by user "donald" ESXWIN2K12R2VM2 [Friday, March 25, :14:02 PM (GMT+05:-30)]: Administration group "Managed computers" has been modified by user "michael" Sample Report Figure 30 Kaspersky Security Center- Malicious object scan status: This report provides information related to malicious object which have been detected or which have been untreated. Logs considered PNPL-TESTLAB7 [Friday, April 22, :47:12 PM (GMT+05:-30)] (<Scan_Objects$0030>): Result: Detected: EICAR-Test-File User: johnson Object: C:\Users\ johnson\downloads\eicar_com (6).zip/eicar.com <EventData><Data>PNPL-TESTLAB7 [Friday, April 22, :47:12 PM (GMT+05:-30)] (<Scan_Objects$0030>): Result: Detected: EICAR-Test-File User: johnson Object: C:\Users\johnson\Downloads\eicar_com (6).zip/eicar.com </Data></EventData> 24

26 Sample Report Figure 31 Kaspersky Security Center- Application privilege management: This report provides information related to applications that have been added to the trusted group. Logs considered PNPL-TESTLAB7 [Thursday, April 21, :05:06 PM (GMT+05:-30)] (Application Privilege Control): Event type: Application placed in the trusted group Application\Name: Microsoft OneDrive Application\Path: c:\users\ johnson\appdata\local\microsoft\onedrive\ Application\Process ID: 8980 User: johnson Component: Application Privilege Control Result\Threat level: Low Result\Precision: Exactly Action: Application placed in group Object: Trusted Object\Type: Group of applications Object\Name: Trusted Reason: Signed by the digital signature of trusted manufacturers 25

27 Sample Report Figure 32 Importing Kaspersky Security Center knowledge pack into EventTracker 1. Launch EventTracker Control Panel. 2. Double click Export Import Utility, and then click Import tab. Import Token Templates/Category/Alert/Tokens/ Flex Reports as given below. Note: Importing should be in the same order as mentioned above. 26

28 Figure 33 Category 1. Click Category option, and then click the browse button. 27

29 Figure Locate All Kaspersky Security Center group of Categories.iscat file, and then click the Open button. 3. To import categories, click the Import button. EventTracker displays success message. Figure Click OK, and then click the Close button. 28

30 Alerts 1. Click Alerts option, and then click the browse button. Figure Locate All Kaspersky Security Center group of Alerts.isalt file, and then click the Open button. 3. To import alerts, click the Import button. EventTracker displays success message. Figure Click OK, and then click the Close button. 29

31 Tokens 1. Click Token value option, and then click the browse button. Figure Locate All Kaspersky Security Center group of Tokens.istoken file, and then click the Open button. 3. To import tokens, click the Import button. EventTracker displays success message. 4. Click OK, and then click the Close button. Figure 39 30

32 Flex Reports 1. Click Report option, and then click the browse button. Figure Locate All Kaspersky Security Center group of Flex Report.issch file, and then click the Open button. 3. To import scheduled reports, click the Import button. EventTracker displays success message. Figure Click OK, and then click the Close button. 31

33 Token Templates 1. Click the Admin menu, and then click Parsing rule. 2. Select Template tab, and then click on Import option. Figure Click on Browse button. Figure Locate All Kaspersky Security Center group of template.ettd file, and then click the Open button. 32

34 Figure Now select the check box and then click on Import option. EventTracker displays success message. 6. Click on OK button. Figure 45 Verifying Kaspersky Security Center knowledge pack in EventTracker Categories 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Categories. 33

35 3. In Category Tree to view imported categories, scroll down and expand Kaspersky Security Center group folder to view the imported categories. Figure 46 Alerts 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Alerts. 3. In Search field, type Kaspersky Security Center', and then click the Go button. Alert Management page will display all the imported Kaspersky Security Center alerts. 34

36 Figure To activate the imported alerts, select the respective checkbox in the Active column. EventTracker displays message box. Figure Click OK, and then click the Activate Now button. NOTE: You can select alert notification such as Beep, , and Message etc. For this, select the respective checkbox in the Alert management page, and then click the Activate Now button. Tokens 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Parsing Rules. The imported Kaspersky Security Center tokens are added in Token-Value Groups list. Please refer Figure

37 Reports Figure Logon to EventTracker Enterprise. 2. Click the Reports menu, and then select Configuration. 3. In Reports Configuration pane, select Defined option. EventTracker displays Defined page. 4. In search box enter Kaspersky Security Center, and then click the Search button. EventTracker displays Flex reports of Kaspersky Security Center. 36

38 Figure 50 Token Template 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Parsing Rules. 37

39 Figure 51 Create Flex Dashboards in EventTracker Schedule Reports 1. Open EventTracker in browser and logon. 2. Navigate to Reports>Configuration. Figure 52 38

40 Figure Select Kaspersky Security Center in report groups. Check Defined dialog box. 4. Click on schedule to plan a report for later execution. Figure 54 39

41 5. Choose appropriate time for report execution and in Step 8 check Persist data in EventVault explorer box. Figure Check column names to persist using PERSIST checkboxes beside them. Choose suitable Retention period. 7. Proceed to next step and click Schedule button. 8. Wait for scheduled time or generate report manually. Create Dashlets 1. EventTracker 8 is required to configure flex dashboard. 2. Open EventTracker in browser and logon. 40

42 3. Navigate to Dashboard>Flex. Flex Dashboard pane is shown. Figure 56 Figure Fill suitable title and description and click Save button. 5. Click to configure a new flex dashlet. Widget configuration pane is shown. 41

43 Figure Locate earlier scheduled report in Data Source dropdown. 7. Select Chart Type from dropdown. 8. Select extent of data to be displayed in Duration dropdown. 9. Select computation type in Value Field Setting dropdown. 10. Select evaluation duration in As Of dropdown. 11. Select comparable values in X Axis with suitable label. 12. Select numeric values in Y Axis with suitable label. 13. Select comparable sequence in Legend. 14. Click Test button to evaluate. Evaluated chart is shown. 42

44 3. If satisfied, click Configure button Figure 59 Figure Click customize to locate and choose created dashlet. 5. Click to add dashlet to earlier created dashboard. 43

45 Sample Dashboards 1. Kaspersky Security Center- Malicious object detected. Figure 61 44