Using the Sumo Logic App for Security Analytics

The Sumo Logic app for Security Analytics provides Dashboards that allow you to easily see and manage your system's status, including a security operations overview, network, system and change, user monitoring, and vulnerabilities on endpoints. This data is collected from your Collectors and Sources, and Sumo Logic Anomaly Detection is applied to it, for instant analysis of any events.

For complete details, see Sumo Logic App for Security Analytics.

Getting Security Incident Details

In the Security Analytics App, on the Network Status Dashboard, the Incident Count or Incidents for Review Panels provide information on all security incidents. You can also drill down from these Panels to the Search page and see more details on those incidents in the Messages tab.

To see incident details in the Messages tab:

Click the Incidents for Review Panel to open the query in the Search page.
Click the Messages tab.
More details for the incident are included in the Message field.

Security Use Cases

The following table provides a list of security use cases, incidents covered, and relevant devices and sources.

Security Analytics Use Case	Security Incidents	Relevant Devices and Sources
User Monitoring	Login Failures followed by success from the same username High amount of login failures for the same username	Windows 2008 servers, Active Directory, Linux, Google Apps, Novell Access Manager, RSA,
User Monitoring	Group Created Group Deleted Group Membership changed	Windows, Active Directory, Google Apps
User Monitoring	User Created on Domain or Application User Created on Local Server User Deleted User Modified	Windows, Active Directory, Google Apps, Linux
Systems and Changes	Configuration Changes OS Update	Windows, Active Directory, Linux
Network Overview	Excessive firewall denies/accepts Single local source scanning multiple destinations on well known database FTP ports Email ports SSH and Web Server ports	Checkpoint
Vulnerabilities on Endpoints	Multiple vulnerabilities detected Same vulnerability detected on multiple hosts Vulnerability found	Qualys
Vulnerabilities on Endpoints	Same virus detected on multiple hosts Virus found	Forefront

Incident Messages and Searches

This table maps incident messages to the preconfigured Security Analytics App searches that report on them.

Incident Message Value	Incident Search
Brute Force Login	SA - Incident - Brute Force Login Attempt
Excessive firewall denies	SA - Incident - Excessive Firewall Denies
High number of malware IDS alerts	SA - Incident - High Number of Malware IDS Alerts
Large number of denied connections	SA - Incident - High Volume of Denied Connections
Increased failed remote logins	SA - Incident - Increase in Failed Remote Login Attempts
Multiple failed logins	SA - Incident - Multiple Failed Logins by a User in Last 15mins
Potential DDos attacks	SA - Incident - Potential DDos Attack
Potential scan or attack through multiple attack vectors	SA - Incident - Potential Scan or Attack through Multiple Vectors
Potential web application scan or attack	SA - Incident - Potential Web Application Attack
Potential successful brute force login	SA - Incident - Successful Login after Multiple Failed Logins
Suspicious SSL Traffic Hike from ...	SA - Incident - Suspicious SSL Traffic