Novell SENTINEL 6.1 SP2, User Manual, Page: 456 / 528

456 Sentinel 6.1 User Guide
no
vd
ocx
(e
n)
7 Ja
nua
ry 201
0
Business Relevance:
Sentinel injects business-relevant contextual data directly into the event stream. It includes up to 135
customizable fields where users can add in asset specific information such as business unit, owner,
asset value, geography. After this information is added into the system, all other components can
take advantage of the additional context.
Figure A-11
Injecting Business Relevance
Exploit Detection: Exploit Detection enables immediate, actionable notification of attacks on
vulnerable systems. It provides a real-time link between IDS signatures and vulnerability scan
results, notifying users automatically and immediately when an attack attempt to exploit a
vulnerable system. This dramatically improves the efficiency and effectiveness of incident response.
Exploit Detection provides users with updates of mappings between IDS and vulnerability scanner
product signatures. The mappings include a comprehensive list of IDS and vulnerability scanners,
Users simply upload vulnerability scan results into Sentinel. Exploit Detection automatically parses
them and updates the appropriate IDS Collectors. It uses the embedded knowledge of vulnerability
status to efficiently and effectively prioritize responses to security threats in real time.
When an attack is launched against a vulnerable asset, Exploit Detection alerts users with the
corresponding severity level of the exploited vulnerability. Users can then take immediate action on
high-priority events. This takes the guesswork out of alert monitoring and increases incident
response efficiency by focusing reaction on known attacks against vulnerable assets.
Exploit Detection also enables users to map or “un-map” signatures and vulnerabilities to tune out
false positives and negatives and to leverage custom signatures or vulnerability scans.
A.4.2 Business Logic Layer
The kernel of the Sentinel platform consists of a set of loosely-coupled services that can run in a
standalone configuration or in a distributed topology. This service-oriented architecture (SOA) is
called iSCALE. Specifically, Sentinel’s SOA comprises a set of engines, services and APIs working
together for linear scaling of the solution against increasing data load and/or processing workload.
Sentinel services run in specialized containers and allow unparalleled processing and scaling
because they are optimized for message-based transport and computation. The key services that
make up the Sentinel Server include: