Network Security Logs là gì? Tại sao quan trọng?
Security Logs là bản ghi sự kiện có dấu thời gian (timestamp) mô tả hoạt động, lỗi, thay đổi trạng thái, truy cập, tấn công... trên hệ thống/mạng. Không log = Không nhìn thấy = Không phát hiện = Không phản hồi. SIEM (Security Information and Event Management) tập trung thu thập, chuẩn hóa, liên kết, cảnh báo từ các log nguồn này.
Phân loại nguồn Log quan trọng theo mức độ ưu tiên (Criticality)
Tier 1: Bắt buộc (Must Have) - Core Visibility
| Nguồn Log | Ví dụ thiết bị/Phần mềm | Thông tin chính (Key Fields) | Mục đích phát hiện |
|---|---|---|---|
| Firewall / Next-Gen Firewall | Palo Alto, FortiGate, Check Point, Cisco FTD, Azure FW, AWS Network FW | Src/Dst IP, Port, Proto, Action (Allow/Denied), App-ID, User, Threat/URL Category, Bytes, Packets, Rule ID | Lateral movement, C2 beaconing, Data exfil, Unauthorized access, Port scan, Malware DL |
| Proxy / Secure Web Gateway (SWG) / Cloud Proxy (Zscaler, Netskope) | Zscaler ZIA, Netskope, Blue Coat, Squid, Microsoft Defender for Cloud Apps | User, URL, Category, File Hash, MIME, Action, Bytes, Risk Score, SSL Inspect Result, DLP Match | Phishing, Malware DL, Shadow IT, Data Exfil (Web), C2 over HTTP/S, Risky SaaS |
| Endpoint Detection & Response (EDR/XDR) | CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR, Elastic Defend | Process Tree, CMD Line, Parent/Child, Hash, MITRE ATT&CK TTP, File/Reg/Net/Behavior Alerts, User, Host | Malware Exec, Living-off-the-land, Credential Access, Persistence, PrivEsc, Ransomware |
| Identity Provider (IdP) / Directory / Auth Logs | Azure AD / Entra ID, Okta, Ping, AD Domain Controllers (Security Log 4624/4625/4740...), RADIUS, MFA Logs | User, IP, Device, Auth Protocol, Result (Success/Fail), MFA Factor, Conditional Access, Risk Level, App | Brute Force, Password Spray, MFA Fatigue, Impossible Travel, Privilege Escalation, Insider |
| Domain Controllers (AD Security Logs) | Windows Event Logs: 4624, 4625, 4672, 4720-4738, 4740, 4768, 4769, 4776, 5136, 5145 | Account, Target, Privileges, Service, Ticket Options, Object Changes, Access Mask | Kerberoasting, AS-REP Roasting, Golden/Silver Ticket, DCSync, Group Policy Mod, Account Creation |
Tier 2: Rất quan trọng (High Value) - Mở rộng Visibility
| Nguồn Log | Ví dụ | Mục đích chính |
|---|---|---|
| Email Security Gateway / Cloud Email Security | Proofpoint, Mimecast, Microsoft Defender for Office 365, Cisco ESA, Google Workspace Security | Phishing, BEC, Malware Attachment/Link, Spam, Impersonation, Account Takeover |
| Cloud Infrastructure (CloudTrail, Audit Logs) | AWS CloudTrail, Azure Activity Log / Entra ID Logs, GCP Audit Logs, OCI Audit | Resource Changes, IAM Changes, Console Login, API Calls, Data Access, Config Drift, Crypto Mining |
| VPN / Zero Trust Network Access (ZTNA) | Palo Alto GlobalProtect, Cisco AnyConnect, FortiClient, Zscaler ZPA, Cloudflare Access, Tailscale | Remote Access Anomalies, Geo-impossible, Split Tunneling Abuse, Credential Reuse |
| Network Detection & Response (NDR) / Packet Capture (Zeek/Suricata) | Corelight (Zeek), ExtraHop, Vectra, Darktrace, Suricata IDS, PCAP | Encrypted Traffic Analysis (JA3/JA3S), Protocol Anomalies, C2 Beaconing, Lateral Movement, Data Staging |
| Vulnerability Scanner / ASM (Attack Surface Management) | Tenable, Qualys, Rapid7, Nuclei, Censys, Shodan, Assetnote | New Vulns, Exploitable Assets, Shadow IT, Expired Certs, Misconfigurations |
| Data Loss Prevention (DLP) / CASB | Forcepoint, Digital Guardian, Microsoft Purview, Netskope, Zscaler CASB, Nightfall | Data Exfiltration (Email, Web, Cloud, USB, Print), Policy Violations, Sensitive Data Discovery |
| DNS Logs (Resolver / Firewall DNS / Protective DNS) | Infoblox, Cisco Umbrella, Azure DNS, AWS Route53 Resolver Query Logs, Quad9, Quad101 | DGA, Fast Flux, C2 Domains, Typosquatting, Newly Registered Domains, Sinkholing |
Tier 3: Quan trọng theo ngữ cảnh (Contextual / Niche)
- Application Logs (Custom Apps, Web Servers - IIS, Nginx, Apache, Tomcat, Java/.NET Apps): Business Logic Abuse, SQLi, XSS, API Abuse, Fraud.
- Database Audit Logs (SQL Server, Oracle, PostgreSQL, MySQL, MongoDB, DynamoDB): Unauthorized Access, Bulk Export, Schema Changes, Privilege Escalation.
- IoT/OT/ICS Logs (PLC, SCADA, HMI, Historians, Firewalls OT): Process Anomalies, Unauthorized Command, Firmware Modification.
- Physical Security (Badge Access, Camera, Visitor Mgmt): Correlation Physical-Logical (Tailgating, After-hours Access).
- Honeypot / Deception / Canary Tokens: High-fidelity Alert (Any interaction = Alert).
- Threat Intelligence Platform (TIP) Feeds: Enrichment IOC (IP, Domain, Hash, URL, CVE).
- Ticketing / ITSM (ServiceNow, Jira): Correlation Alert ↔ Incident ↔ Change ↔ Vuln.
Best Practices thu thập Log cho SIEM
- Chuẩn hóa (Normalization): Map về Common Information Model (CIM - Splunk), ECS (Elastic), OCSF (Open Cybersecurity Schema Framework). Parsing đúng timestamp, field extraction.
- Ưu tiên chất lượng hơn lượng: Bật log cấp độ Information/Verbose cho nguồn Tier 1. Tắt Debug/Trace trừ khi troubleshoot. Filter noise tại nguồn (Firewall: log deny + allow critical; Proxy: log all; AD: Audit Policy tinh chỉnh).
- Time Sync (NTP): Mọi nguồn log PHẢI đồng bộ giờ chính xác (NTP server nội bộ). Sai giờ → Không correlate được.
- Transport Bảo mật & Tin cậy: Syslog TLS (6514), HTTPS/HEC (Splunk), Kafka TLS, Azure Monitor/Event Hub, AWS Kinesis/Firehose. Tránh UDP Syslog (mất gói, không mã hóa).
- Retention & Compliance: Hot (30-90d) → Warm (1yr) → Cold/Archive (7yrs tuân thủ PCI/DSS, GDPR, luật địa phương). Immutable storage cho forensic.
- Enrichment tại SIEM: GeoIP, ASN, Threat Intel (IOC), Asset Inventory (CMDB), User Identity (HR/AD), Vuln Data (Scanner).
- Rule Development: Signature-based (Known bad) + Behavioral/Anomaly (UEBA, ML) + MITRE ATT&CK Mapping + Risk-Based Alerting (RBA).
- 3 Nguồn log TUYỆT ĐỐI cần cho SIEM tối thiểu: Firewall + IdP/Auth (AD/Entra/Okta) + EDR. Thiếu 1 trong 3 = Mù loà lớn.
Log Source Identifier (QRadar / SIEM Specific)
Khi cấu hình Log Source trong SIEM (IBM QRadar, Splunk, LogRhythm...), cần định danh:
- Log Source Identifier: IP quản trị (Management IP) hoặc Hostname (FQDN) của thiết bị gửi log. Dùng IP nếu DNS không ổn định.
- Type/Protocol: Syslog TLS, WinCollect, Agent, API, Cloud Connector...
- Coalescing Events: Gom nhóm event tương tự giảm volume (cẩn thận làm mất context).