ArcSight Express for the Mid-Market

Transcription

1 ArcSight Express for the Mid-Market Dhiraj Sharan Software Development Manager September ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.

2 Agenda Introducing ArcSight Express Installing AE AE Features Upgrading/Patching Licensing Options FAQ ArcSight Confidential 2

3 Introducing ArcSight Express 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 3

4 ArcSight Express for the Mid-Market ArcSight Express is a Security Information and Event Management (SIEM) solution that provides the essentials for network perimeter and security monitoring by leveraging the superior correlation capabilities of ArcSight ESM in combination with an ArcSight Logger storage appliance ArcSight Express Appliance (NEW MODEL M7200) ArcSight Storage Appliance (NEW MODEL L3200) ArcSight Confidential 4

5 ArcSight Express Security Expert In a Box Tailored for the mid-market use-cases Bots, worms, and viruses Hacker detection Bandwidth hogs and policy violation Unauthorized application and system access detection VPN sneak attack detection System and user impact Compliance audit readiness Sarbanes-Oxley, PCI DSS, Gramm-Leach-Bliley, FISMA, Basel II and HIPAA Each can be extended with pre-built compliance insight packs ArcSight Confidential 5

6 About the ArcSight Express Appliance Hardware specs (NEW M7200 Model) Chassis: Dell PowerEdge R710, Form Factor: 2U Memory: 24GB, Processors: 2xIntel Xeon Quad Core (8 cores), 2.0GHz Disks: 6x600GB SAS, 15kRPM, RAID 10, i.e. ~1.8TB effective storage Operating system: Oracle Enterprise Linux bit Software Oracle Database Oracle Home at /home/oracle/orahome10g, Data files at /opt/data ArcSight Manager 4.5 SP1 /opt/arcsight/manager ArcSight Database 4.5 SP1 /opt/arcsight/db ArcSight Web 4.5 SP1 /opt/arcsight/web ArcSight Forwarding Connector 4.5 SP1 /opt/arcsight/connector (forwards all events to Storage Appliance) ArcSight Confidential 6

7 About the ArcSight Storage Appliance Hardware specs (NEW L3200 Model) Chassis: Dell PowerEdge R410, Form Factor: 1U Memory: 8GB, Processors: 1xIntel Xeon Quad Core, 2.0GHz Disks: 2x1.5TB SATA, RAID 1, i.e. 1.5TB effective storage Operating system: Oracle Enterprise Linux bit Software Logger 3.0 SP1 Patch ArcSight Confidential 7

8 ArcSight Express Deployment Diagram ArcSight Express Appliance ArcSight Express Admin Console ArcSight Express Manager ArcSight Express Real-time Database Long-Term Storage UI Web Browser ArcSight Web Server Forwarding Connector ArcSight Express Storage Appliance ArcSight SmartConnectors Web Browser Network Devices ArcSight Confidential 8

9 ArcSight Express Communications Diagram SSL #8443 Admin Console SSL #8443 Web Browser SSL #9443 Forwarding Connector SSL #443 Web Browser SSL #443 Storage Appliance UI ArcSight Confidential 9

10 Development Goals for Engineering Team Design for mid-market Design for international markets, i.e. support localization English, Traditional Chinese, and Japanese Use regular ESM software releases, patches, SPs Simplify, automate, and shorten ESM installation ESM upgrade Ask bare minimum questions during install Make upgrade automated and non-interactive Reduce Oracle management overhead and follow space-based retention ArcSight Confidential 10

11 Installing ArcSight Express 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 11

12 Configuring Storage Appliance Follow standard Logger setup with these choices 1. Define Storage Volume - allocate 100% of the storage 2. Create Default Storage Group define retention, example Maximum Age: 365 days Maximum Size: 1 TB 3. Configure NTP (optional, but strongly recommended) 4. Indexing - set to default fields 5. Reboot Appliance to commit the changes 6. Create SmartMessage Receiver (see next slide) ArcSight Confidential 12

13 Creating SmartMessage Receiver Edit Enable Delete Configuration Settings Event Input/Output Receivers ArcSight Confidential 13

14 ArcSight Express Appliance Setup Video ArcSight Confidential 14

15 Configuring SmartConnectors Install and register SmartConnectors (software) Can use Connector Manager and on-board SmartConnectors on Storage Appliance Connector Hosting and Management ArcSight Express Manager SmartMessage Receiver Forwarding SmartConnector ArcSight Express Appliance Storage Appliance ArcSight Confidential 15

16 ArcSight Express Features 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 16

17 ArcSight Express Features All ESM features available* EPS up to 2,500* Available user interfaces Space based retention ArcSight Express content Factory reset *Licensing restrictions apply ArcSight Confidential 17

18 ArcSight Express User Interfaces ArcSight Web Browser based regular ESM client Primarily an operations interface, but allows limited customization HTTPS ArcSight Express Admin Console Regular ESM Console For admin and content authoring ArcSight Storage Appliance UI Brower based regular Logger interface Both an operations and management interface for long-term storage and connector management ArcSight Confidential 18

19 ArcSight Web The Primary User Interface Home Page with summary view Dashboards Reports Active Channels View Cases Ack. Notifications ArcSight Confidential 19

20 Space Based Retention Designed for AE (compared to Time Based Retention for regular ESM) Automatic space management Retains approx. 1 billion events online (1.2TB for events in M7200) Automatically drops oldest day s partition (Target free space 15%) Events still available in Storage Appliance No partition archiving Data in Oracle is online-compressed ArcSight Confidential 20

21 ArcSight Express Content Primary purpose Perimeter and Network Security Monitoring Basic Compliance Monitoring Event Correlation across 8 device types Anti-Virus Events Database Events Firewall Events IDS - IPS Events Identity Management Events Network Events Operating System Events VPN Events ArcSight Confidential 21

22 Content Descriptions ArcSight Confidential 22

23 Patching and Upgrading 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 23

24 Patching and Upgrading We certainly don t want this ArcSight Confidential 24

25 Patching and Upgrading ArcSight Express Appliance Download and run aeupdate-<versionstring>.pl Upgrades ALL components Oracle CPU ArcSight Manager ArcSight DB ArcSight Web ArcSight Forwarding Connector Was that difficult? ArcSight Confidential 25

26 If you Want to know More RPM based install/upgrade is applied Check RPM versions with rpm -qa grep arcsight sort Upgrade steps behind the scenes Software components backed up at /opt/arcsight/db.preupgradebackup /opt/arcsight/manager.preupgradebackup /opt/arcsight/web.preupgradebackup /opt/arcsight/connector/<build> ArcSight system tables from Oracle backed up at /opt/arcsight/db.preupgradebackup/arcsight.dmp Regular ESM upgrade wizards run in silent mode Logs Detailed logs in individual components logs directories Summary logs in /opt/updates directory *.res - shows the result of the operation *.log - records the details of the upgrade process * stands for the name of the self-extracting perl file Manual rollback steps as per documentation ArcSight Confidential 26

27 ArcSight Express Licensing 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 27

28 Model Choices * L3000 Storage Appliance not included with M7100-M NOTE: Updates pending for new M7200 and L3200 models ArcSight Confidential 28

29 More on Licensing Items included in ArcSight Express license (for all models) 1 Admin Console for authoring Unlimited Web Console Pre-built ArcSight Express content Additional licensing options Option to buy additional Consoles (for all models) Option to buy bigger Logger (for L and X models only) Option to upgrade to ESM (for X model only), including Ability to expand beyond max devices Ability to add EnterpriseView Ability to add TRM ArcSight Confidential 29

30 Frequently Asked Questions 2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners ArcSight Confidential 30

31 Frequently Asked Questions How do I modify configuration AFTER FirstBoot Wizard has been run? /opt/arcsight/manager/bin/arcsight managersetup /opt/arcsight/db/bin/arcsight database pc /opt/arcsight/web/bin/arcsight websetup /opt/arcsight/connector/current/bin/arcsight connectorsetup What kind of SSL certificates are used? Self-signed certificates Console now lets you see and accept untrusted certificate Refer to ArcSight Express Configuration Guide for exporting using arcsight keytoolgui and importing it in the Connector Manager on Storage Appliance Is there training on ArcSight Express? There is 4 day instructor-led training (virtual classroom option available) See ArcSight Confidential 31

32 ArcSight Confidential 32

33 Documentation Getting Started with ArcSight Express Rack Installation Guide ArcSight Express Release Notes ArcSight Express Configuration Guide ArcSight Express Content Guide ESM documents ArcSight ESM Installation and Configuration Guide ArcSight ESM Administrator s Guide Logger documents Release Notes Getting Started with ArcSight Logger ArcSight Logger Administrator s Guide Connector documents SmartConnector Configuration Guide for ArcSight Forwarding Connector SmartConnector User s Guide ArcSight Confidential 33