Novell SENTINEL 6.1 SP2, Руководство пользователя, Страница: 458 / 528

458 Sentinel 6.1 User Guide
no
vd
ocx
(e
n)
7 Ja
nua
ry 201
0
correlation engine works with a rules checker component which computes the correlation rule
expressions and validates syntax of filters. In addition to providing a comprehensive set of
correlation rules, Sentinel’s correlation engine provides specific advantages over database-centric
correlation engines.

By relying on in-memory processing rather than database inserts and reads, the correlation
engine performs during high steady-state volumes as well as during event spikes when under
attack, the time when correlation performance is most critical.

Correlation volume does not slow down other system components, so the user interface
remains responsive, especially with high event volumes.

Distributed correlation: Organizations can deploy multiple correlation engines, each on its own
server, without the need to replicate configurations or add databases. Independent scaling of
components provides cost-effective scalability and performance.

The correlation engine can add events to incidents after an incident has been determined.
Users are encouraged to measure a metric called Event Rules per Second (ERPS). ERPS is the
measure of the number of events that can be examined by a correlation rule per second. This
measure is a good performance indicator as it estimates the impact on performance when two factors
intersect: events per second and number of rules in use.
 Dynamic Lists: Dynamic lists are distributed list structures that can be used for storing
elements and performing fast lookups on those elements. These lists can store a set of strings
such as IP addresses, server names or usernames. Examples of dynamic lists include:
 Terminated user list

Suspicious user watch list
 Privileged user watch list

Authorized ports and services list
 Authorized server list

In all cases, correlation rules might reference named dynamic lists to perform lookups on list
members. For example, a rule can be written to identify a file access event from a user who is
not a member of the Authorized Users list. Additionally, correlation actions integrate with the
dynamic list module to add or remove elements from a list. The combination of lookups and
automated actions on the same list provides a powerful feedback mechanism used to identify
complex situations.
Workflow Service (iTRAC)
The Workflow Service receives triggers on incident creation and initiates workflow processes based
on pre-defined workflow templates. It manages the lifecycle of these processes by generating work
items or executing activities. This service also maintains a history of completed processes that can
be used for auditing incident responses.
Event Visualization
Active Views
TM
, the interactive graphical user interface for event visualization, provides an
integrated, security management dashboard with a comprehensive set of real-time visualization and
analytical tools to facilitate threat detection and analysis. Users can monitor events in real time and
perform instant drill-downs from seconds to hours in the past. A wide array of visualization charts
and aids allow monitoring of information through 3D bar, 2D stacked, line and ribbon chart