Seitenhistorie

...

Description:

A SIEM system (Security Information and Event Management) dient dazu, Bedrohungen im Netzwerk in Echtzeit zu erkennen und geeignete Gegenmaßnahmen zu ergreifen. Dazu sammelt das SIEM-System Logs von Netzwerk-Komponenten und wertet diese aus.serves to recognize threats in the network in real time and take appropriate countermeasures. For this purpose, the SIEM system gathers logs from network components and analyzes these.

This article describes how a SIEM system can be used with In diesem Artikel wird beschrieben, wie SIEM mit LANCOM R&S®Unified Firewalls in der the LMC verwendet werden kann.

Requirements:

• Ihre Your LANCOM Unified Firewall muss durch die LMC verwaltet werden
  • Die Unified Firewall muss einem Standort zugewiesen sein
  • Die Unified Firewall muss im Modus Gateway sein 
• Zugang zur LMC zur Aktualisierung der Unified Firewall und Rollout der Konfiguration
• must be managed by the LMC 
  
  • The Unified Firewall must be assigned to a site 
  • The Unified Firewall must be assigned the role Gateway
• Access to the LMC to update and roll out the configuration of the Unified Unified Firewall
• LCOS FX as of version LCOS FX ab Version 10.13 Rel (download aktuelle Version)Bereits konfiguriertes und funktionsfähiges SIEM-Systemlatest version)
• Configured and functional SIEM system

Procedure:

1) Activate SIEM support in the LMC:

...

2) Provide IDPS messages of from the Unified Firewall for the SIEM system:

2.1) After activating SIEM support the Unified Firewall changes to the state Nicht aktuellstate Outdated. Roll out the configuration to the Unified Firewall, so that the IDPS alerts are provided.

Image RemovedImage Added

Image RemovedImage Added

2.2) Connect to the Unified Firewall via the WEBconfig tunnel in the LMC and check in the menu Monitoring & Statistics → Settings, if the additional column LMC was rolled out and if the option is activate for active for IDPS Alert.

Image Modified

3) Generate a SIEM API Secret in the LMC:

3.1 Wechseln Sie in der LMC in das Menü Projektvorgaben → Externe Dienste → SIEM und klicken auf ) In the LMC go to the menu Project specifications → External services → SIEM and click on Create API Secret Key erstellen.

Image RemovedImage Added

3.2 Kopieren Sie den Secret Key und speichern diesen gesichert ab. Tragen Sie den Secret Key anschließend in Ihrem SIEM-System ein.

Image Removed

) Copy the Secret Key and save it in a secure location. Enter the Secret Key in your SIEM system afterwards.

Image Added

4) Example commands in the SIEM 4. Beispiel-Befehle in der SIEM- API:

Um die SIEM-API verwenden zu können, benötigen Sie die UUID Ihres LMC-Projektes sowie den In order to be able to use the SIEM API, you need the UUID of your LMC project as well as the API Secret Key (siehe Schritt see step 3).

DeviceLogs:Mit dem Endpunkt DeviceLogs können die Geräte-Logs für den angegebenen Account ausgelesen werden

With the endpoint DeviceLogs you can read out the device logs for the specified account.

GET curl --request GET \
  --url https://cloud.lancom.de/cloud-service-siem/accounts/<UUID desof your LMC-Projektes> project>/logs \
  --header 'HTTP/1.1
Host: cloud.lancom.de
Authorization: LMC-API-KEY <API Secret Key aus(see Schritt 3>' \step 3)>

curl --request GET \
  --url https://cloud.lancom.de/cloud-service-siem/accounts/ea96d5d0-01f6-498a-b9ec-629be24eae9e/logs \
  --header 'Authorization: LMC-API-KEY eyJraWQiOiIxIiwidHlwIjoiTE1DLUFQSS1LRVkiLCJhbGciOiJIUzI1NiJ9.3zezFHKzCYJlCgh-3V1KN0yEe8lTUQEE75DXc-Vv2Dc._93wf35NVk8Q6yt7omWzyohTgW58424tQzRFIPgr111' \

{
  "startOffset": 10,
  "endOffset": 109,
  "nextOffset": 110,
  "count": 100,
  "deviceLogs": [
    {
      "deviceId": "ea96d5d0-01f6-498a-b9ec-629be24eae9e",
      "accountId": "ea96d5d0-01f6-498a-b9ec-629be24eae9e",
      "siteId": "ea96d5d0-01f6-498a-b9ec-629be24eae9e",
      "messageId": "8bb136e3-0c4e-459e-8cd7-85b8209e2e3b",
      "createdAt": "2022-12-21T13:17:40.78731Z",
      "receivedAt": "2022-12-21T13:17:40.78731Z",
      "rawMessage": "IDPS: Malicious message detected [Classification: ] [Severity: 3] [Signature Id: 5000000] [Action: allowed] [Source: 10.10.10.20:0] [Destination: 8.8.76.5:0]",
      "severity": "3",
      "additionalProperties": {
        "category": "IDPS",
        "idps_event_type": "alert",
        "signature": "5000000",
        "idps_category": "",
        "source_ip": "10.10.10.20",
        "source_port": "0",
        "destination_ip": "8.8.76.5",
        "destination_port": "0",
        "action": "allowed"
      }
    }
  ],
  "_links": {
    "self": "https://cloud.lancom.de/cloud-service-siem/accounts/ea96d5d0-01f6-498a-b9ec-629be24eae9e/logs?offset=1&limit=100",
    "next": "https://cloud.lancom.de/cloud-service-siem/accounts/ea96d5d0-01f6-498a-b9ec-629be24eae9e/logs?offset=101&limit=100"
  }
}

Offsets:Mit dem Endpunkt Offsets wird für den angegebenen Account die Nummer der ersten und der nächsten ungelesenen Log-Datei sowie die Grenze an Log-Dateien ausgegeben

With the endpoint Offsets you can read out the number of the first logfile and the next unread logfile as well as the offset limit for the specified account.

GET /cloudcurl --request GET \
--url https://cloud.lancom.de/cloud-service-siem/accounts/<UUID desof your LMC-Projektes> project>/offsets \
--header 'HTTP/1.1
Host: cloud.lancom.de
Authorization: LMC-API-KEY <API Secret Key aus(see Schritt 3>' \step 3)>

curl --request GET \
--url https://cloud.lancom.de/cloud-service-siem/accounts/30995a43-3705-439a-9c2c-da1331bb5106/offsets \
--header 'Authorization: LMC-API-KEY eyJraWQiOiIxIiwidHlwIjoiTE1DLUFQSS1LRVkiLCJhbGciOiJIUzI1NiJ9.3zezFHKzCYJlCgh-3V1KN0yEe8lTUQEE75DXc-Vv2Dc._93wf35NVk8Q6yt7omWzyohTgW58424tQzRFIP11111' \

{
  "startMinOffset": 0,
  "nextUnreadOffset": 99,
  "endMaxOffset": 100
}

...