Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 425 / 588

21-5
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 21 Rules
Constructing a Rule
Note For releases 4.2.3 and earlier of MARS, you cannot define drop rules for a NetFlow-based event. For
these releases, tuning of NetFlow events must be performed on the reporting device.
Constructing a Rule
Each step of your plan corresponds to a line of a rule. Each line identifies a set of conditions. A rule can
have a single line, two lines, or multiple lines. You link these lines together using the logical operators,
“AND, OR, FOLLOWED-BY (in time).”
For more information on the conditions and operators found in a rule, see Table 21-1 on page 21-6 .
The first step of the example plan, identified in Back to Being the Admin, page 21-3 , involved probing
the target host. You can express a probe by selecting the appropriate event type groups as the line’s event
type criteria. Also, you want to use dollar variables ($TARGET)
1
to constrain your host to ensure that
For more information on the conditions and operators found in a rule, see Table 21-1 .
The first step of the example plan, identified in the section Back to Being the Admin, page 21-3 , involved
probing the target host. You can express a probe by selecting the appropriate event type groups as the
line’s event type criteria. Also, you want to use dollar variables ($TARGET)
2
to constrain your host to
ensure that the probe and attacks that are reported have happened to the same host. Then you need to
figure out the logical step for the next line. In this case, the probe could be optional depending on the
time frame that the probe was sent and its subtlety.
Rule logic is simple. You have a row. Every row has cells. 'The logical expressions connecting different
cells are “and,” while the expressions connecting items inside a cell are either “or” or “and not”,
depending which clause is chosen—the equal to or not equal to.
By studying the system inspection rules, you can identify three commonly used rules: attempts, success
likely, and failures, The most common rule structure is the basic three-line rule that identifies an
attempted attack. It is expressed as:
(Probe AND
Attack) OR
Attack)
Note
To clarify this pseudocode, keep in mind that uppercase AND, OR and FOLLOWED-BY identify a
logical operator between two rule lines. Lowercase “and” identifies a logical operator between two cells.
Lowercase “or” and “and not” identify a logical operator between two items within a cell.
Success likely rules extend the attempt rules by identifying suspicious activities originating from the
attacked host. The general structure of these rules is:
((Probe AND
Attack) OR
Attack)) FOLLOWED BY
1. A variable, such as ($TARGET), serves two purposes in the rule: 1.) It captures the number of times the same cell value is
matched upon—the count for that cell, e.g., ten login failures from the same source address. 2.) It correlates the same value
of a cell across rule lines, e.g., a probe from a source address AND an attack from that same source address.
2. A variable, such as ($TARGET), serves two purposes in the rule: 1.) It captures the number of times the same cell value is
matched upon—the count for that cell, e.g., ten login failures from the same source address. 2.) It correlates the same value
of a cell across rule lines, e.g., a probe from a source address AND an attack from that same source address.