Cato Networks

The Sumo Logic app for Cato Networks provides real-time insights into the events and helps you to identify potential security threats with admin activities. This app offers a comprehensive suite of dashboards that monitor network events, analyze threats, and track administrative activities, which empowers you with actionable intelligence for network management and security.

Key features and benefits of the Cato Networks app include:

• Security event analysis. Detect and respond to security threats in the Cato Networks environment. It provides a holistic view of event-related metrics and insights. This dashboard enables users to identify trends, assess risks, and make informed decisions regarding network events.
• Threat analysis. This app offers a comprehensive overview of threat-related information that allows you to understand and address potential risks effectively, thereby supporting risk management and response strategies.
• Audit summary. This app includes pre-built reports and visualizations of audit logs which facilitates effective monitoring, analysis, and identification of any unusual or suspicious activities within the system.
• Customization and Integration. Customize and tailor your dashboards, reports, and alerts to align specific monitoring and security needs. It also supports integration with other security tools and platforms, enabling a centralized view of the overall security landscape.

Log types

This app uses the Sumo Logic Cato Networks source to collect Events Feed and Audit Feed data from Cato Networks platform.

Sample log messages

Events Feed

{
   account_id: "1714",
   action: "Succeeded",
   api_name: "eventsFeed",
   api_type: "query",
   authentication_type: "APIKEY",
   event_count: "1",
   event_sub_type: "ApiKey",
   event_type: "Connectivity",
   internalId: "9jlo",
   key_name: "Peter",
   login_type: "API",
   src_country: "Ireland",
   src_country_code: "IE",
   src_ip: "128.200.100.1",
   src_is_site_or_vpn: "API",
   src_site: "US",
   time: "1682856852500"
}

Audit Feed

{
   account_id: "1714",
   admin: "peter@mail.com",
   admin_id: "4472",
   change_type: "DELETED",
   creation_date: "1682683010000",
   insertion_date: "1682684083127",
   model_name: "Temp jscript driveby",
   model_type: "IPSWISTRULE",
   module: "Ips Whitelist Rule"
}

Sample queries

Total Threat Events

_sourceName="source" event_type  
| json "user_name", "api_type", "event_message", "application", "api_name", "file_size", "socket_interface", "matched_data_types", "rule", "device_name", "src_site", "internalId", "dlp_profiles", "ip_protocol", "custom_categories", "src_isp_ip", "threat_verdict", "src_ip", "action", "file_type", "dest_is_site_or_vpn", "file_name", "is_sanctioned_app", "vpn_user_email", "threat_type", "dest_ip", "risk_level", "domain_name", "src_is_site_or_vpn", "account_id", "event_sub_type", "signature_id", "rule_id", "host_mac", "client_class", "user_reference_id", "event_type", "full_path_url", "host_ip", "rule_name", "severity", "login_type", "mitre_attack_tactics", "os_version", "src_country", "time", "dest_port", "application_risk", "categories", "src_port", "mitre_attack_subtechniques", "dest_site", "traffic_direction", "link_type", "event_count", "ISP_name", "mitre_attack_techniques", "authentication_type", "os_type", "dest_country", "key_name", "threat_reference", "url", "threat_name", "tunnel_protocol", "dest_country_code", "client_version", "src_country_code", "pop_name" as user_name, api_type, event_message, application, api_name, file_size, socket_interface, matched_data_types, rule, device_name, src_site, internalId, dlp_profiles, ip_protocol, custom_categories, src_isp_ip, threat_verdict, src_ip, action, file_type, dest_is_site_or_vpn, file_name, is_sanctioned_app, vpn_user_email, threat_type, dest_ip, risk_level, domain_name, src_is_site_or_vpn, account_id, event_sub_type, signature_id, rule_id, host_mac, client_class, user_reference_id, event_type, full_path_url, host_ip, rule_name, severity, login_type, mitre_attack_tactics, os_version, src_country, time, dest_port, application_risk, categories, src_port, mitre_attack_subtechniques, dest_site, traffic_direction, link_type, event_count, ISP_name, mitre_attack_techniques, authentication_type, os_type, dest_country, key_name, threat_reference, url, threat_name, tunnel_protocol, dest_country_code, client_version, src_country_code, pop_name nodrop

| where !isnull(risk_level)
| where !isnull(src_country)

//filters
| where src_is_site_or_vpn matches "{{source_type}}"
| where event_type matches "{{event_type}}"
| where event_sub_type matches "{{event_sub_type}}"
| where risk_level matches "{{risk_level}}"
| where src_country matches "{{src_country}}"

| where !isnull(threat_name)
| count_distinct(internalId)

Total Audit Logs

_sourceName="source" admin
| json "account_id", "admin", "admin_id", "change_type", "creation_date", "insertion_date", "model_name", "model_type", "module" as account_id, admin, admin_id, activity, creation_date, insertion_date, model_name, model_type, module nodrop

//filters
| where activity matches "{{activity}}"
| where module matches "{{module}}"

| count(admin_id)

Set up collection

Follow the instructions for setting up Cato Networks source and use the same source category while installing the app.

Installing the Cato Networks app

To install the app, do the following:

1. From the Sumo Logic navigation, select App Catalog.
2. In the Search Apps field, search for and then select your app.
   Optionally, you can scroll down to preview the dashboards included with the app.
3. To install the app, click Install App.
4. Click Next in the Setup Data section.
5. In the Configure section of the respective app, complete the following fields.
   1. Key. Select either of these options for the data source.
      • Choose Source Category, and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
6. Click Next. You will be redirected to the Preview & Done section.

Your app will be installed in the Installed Apps folder and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, updating with full graphs and charts over time.

Viewing Cato Networks dashboards

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

• You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
• You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
• Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Events

The Cato Networks - Events dashboard provides a detailed summary of the event-related metrics and insights. This dashboard provides a holistic view of event-related information, enabling users to identify trends, assess risks, and make informed decisions.

• Total Events. Displays the total number of events that allows you to gauge the scale of activity.
• Events by Type. The distribution of events by type provides a breakdown of the different categories, offering valuable context.
• Tunnel Protocol Distribution. The tunnel protocol distribution showcases the usage of different protocols, indicating potential security concerns.
• Events from Risky Geo Locations. The geo-locations of risky sources that represent potentially problematic areas.
• Action Distribution. Highlights the distribution of actions taken in response to events.
• Events by Sub Type. The distribution of events by sub-type provides a breakdown of the different categories, offering valuable context.
• Top 10 Source Countries. The top source countries highlight events' geographic origins, which enables you to identify the source country of the threat.
• Top 10 Destination Countries. The top destination countries highlight events' geographic destinations, which enables you to identify the destination country of the threat.
• Top 10 ISPs. The top ISPs reveal the service providers associated with these events, aiding in further analysis.
• Top 10 POP Names. The top POP names shed light on specific points of presence that might require attention.
• Source Site/VPN Details. Source site/VPN details offer insights into the source of events and the usage of VPNs.

Threat Analysis

The Cato Networks - Threat Analysis dashboard provides a comprehensive overview of threat-related information, enabling you to understand and address potential risks effectively.

• Total Threat Events. Displays the total number of threat events, giving you an overall understanding of the threat landscape.
• Threats Frequency. The threats frequency widget highlights the frequency of threats, allowing you to identify patterns and trends.
• Threats by Type. The threat by types widget categorizes threats and provides insights into the specific types of threats encountered.
• Geo Locations of Threat's Source. The geo locations of threat sources provide visual representations of where threats originate, aiding in identifying potential hotspots.
• Geo Locations of Threat's Destinations. The geo locations of threat destinations provide visual representations of where they are targeted, aiding in identifying potential hotspots.
• Threats by Risk Level. The threats by risk level widget offer a classification of threats based on the severity and help you prioritize your response efforts.
• Top Attack Signatures. The top attack signatures widget highlights the most common attack patterns, allowing you to focus on the most significant risks.
• Top Threats. The top threats widgets highlight the specific threats allowing you to focus on the most significant risks.
• MTRE Attack Summary. The MITRE summary provides a concise overview of the relevant MITRE AT and CK framework for understanding the tactics and techniques associated with threats.
• Threats Over Time.The threats over time widget shows the trend of threats, assisting in monitoring the evolving threat landscape.

Audit Feed

The Cato Networks - Audit Feed dashboard offers a comprehensive summary of audit log activities, which provides valuable insights into system administration and changes.

• Total Audit Logs. Displays the total number of audit logs which gives you an overview of the scale and volume of recorded activities.
• Activity Types. The activity types widget categorizes the types of activities recorded, offering a breakdown of the different actions performed.
• Top 10 Active Admins. The top 10 active admins widget highlights the most actively involved administrators, providing visibility into their level of engagement.
• Admin Activities Over Time. The admin activities over time widget showcases the trend of administrative activities, enabling you to identify patterns and potential anomalies.
• Top 10 Modules Changed. The top modules changed widget identifies the specific modules that have undergone the most modifications, offering insights into areas that require further investigation or monitoring.
• Top 10 Objects Changed. The top objects changed widget identifies the specific objects that have undergone the most modifications, offering insights into areas that require further investigation or monitoring.
• Audit Summary. The audits summary widget provides a concise summary of key audit log details, helping you to quickly understand the nature of the recorded activities.