ArcSight Express
Name :- Vasant Kumar, Channel Sales Engineer India & ASEAN
Date :- 13th October 2010
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
Agenda
Event Management Challenges ArcSight Express Product Overview
Rapid Implementation
Growth Path Q&A
Event Management Challenges
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
Millions Of Events From Disparate Sources
Firewalls Firewalls Firewalls Firewalls Firewalls/ Firewalls VPN Intrusion Detection Systems Vulnerability Assessment Network Equipment Sign-On Identity Sign-On Management Server and Desktop OS Directory Services Applications Applications Applications Applications Applications Applications Applications Applications Applications Anti-Virus Applications
Anti Anti Virus Databases Virus
Mainframes
User Attributes
Physical Infrastructure
Business Processes
Critical events lost in sea of events and most attacks and misconfigurations 100sgo ofcompletely Millions Events Per Day undetected
Islands of defense Overwhelming flood of logs Week long manual investigations
Massive false positives Heterogeneous consoles Many different formats
Missing an Attack can be Catastrophic
When Events Go Unnoticed, Bad Things Happen
Threat Response Time is Critical
How Long Does It Take To Respond Once a Problem is Discovered?
Reduce risk and cost by dramatically reducing the time it takes to effectively respond
Risk/Cost
Time to Remediate
An Event Management Solution
Must be able to : Collect events from a wide variety of sources Correlate and build context in real-time Analyze and prioritize the most critical events Shift focus to malicious activity and immediate threats Provide immediate risk identification and mitigation Scale without requiring a replacement solution
ArcSight Express Product Overview
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
ArcSight Express: Fast, Easy Security Automation
Your Security Expert In a Box
World-Class Event Correlation Capabilities Market-Leading Log Management Functionality Simple Browser-based Operator Console Handles Most Common Security and Compliance Issues Out of the Box
Perimeter & Network Security Monitoring Broad Compliance Controls
Minimal Administrative Overhead
2009 ArcSight Confidential
Targeted at Problems That Matter Most
Bot, Worm, and Virus Attacks
Is this a zero-day outbreak?
VPN Sneak Attacks
Where are my remote access connection requests coming from? Who are the top remote users that have auth failures? When do my remote users access my systems?
Hacker Detection
Who is attacking me? What are they attacking?
Bandwidth Hogs and Policy Violations
What users are bandwidth hogs? What protocols are they using? Which systems are affected by this worm or virus? Which user maps to this IP address?
Unauthorized Application Access
What servers are accessed most? Where are the most access events coming from? What systems have compromised accounts? Which users are generating the most login failures? Which critical systems have suspicious login activity?
System and User Impacts
Failed Audits, Fines and Penalties
Which reports are needed for this regulation? Which requirements are not in compliance?
Market Leading Integration
ArcSight Connectors
Collect native log formats from 275+ products Centralized or Distributed collection Normalize to a common format Device independent categorization Secure, reliable transport
Available options:
Rackable Appliances (C3000/C5100)
Branch Office/Store Appliance (C1000)
Installable Software
Benefit: Insulates device choices from analysis
ArcSight Express Event Collection: 275+ Products, 50+ Categories, 80+ Partners
Access and Identity Anti-Virus Applications Content Security Database
Data Security Firewalls Honeypot Host IDS/IPS Network IDS/IPS
Integrated Security Log Consolidation Mail Filtering Mail Server Mainframe
NBAD Network Management Network Monitoring Net Traffic Analysis Operating System
Policy Management Router Security Management Switch VPN
Vulnerability Mgmt Web Cache Web Filtering Web Server Wireless
Assured Integrity and Reliability with a Robust Connector Architecture
Events
Centralized Updates/Upgrades Compressed Event Stream
ArcSight Connector
Heartbeat Connection Bandwidth Management
ArcSight Monitoring
Follows NIST 800-92 Log Aggregation Guidelines
Normalization and Categorization
UNIX Failed Login Event
Oracle Failed Login Event
Windows Failed Login Event
Benefit: Future-proof your analysis and monitoring
Market Leading Correlation Engine
ArcSight Express Correlation
Real-time, in memory event analysis across 8 device categories Prescriptive, Pre-Built Correlation Rules Advanced Intelligence: millions of events important incidents
Data Center Rackable Appliance
Benefit: Focus scarce resources on relevant threats
ArcSight Express Correlation Helps Find Needles in the Haystack
Anti-Virus Databases
Network Equipment
Intrusion Detection Systems
Server and Desktop OS
Access Management
VPN Devices
Firewalls
Identified . threats
Millions: Raw Events Thousands: Security Relevant Events Hundreds: Correlated Events
Cross Device
Business-critical IT assets
Risk-based Prioritization
Critical Events Surfaced
Correlation
Intelligent Correlation For Real-Time Monitoring of Malicious Activity
In Memory Correlation
22 Real-Time Correlation Rules, Real-Time Monitoring
Statistical Correlation
Find Baselines and Report Deviations from Normal Behavior
Historical Correlation
Correlation of Past Events, Scheduled or On-Demand Correlation
Connector Categorization
Active Lists
Automatic Threat Escalation
Risk Based Prioritization
Reduction of False Positives
Pre-Built Rules
Immediate deployment
Leverage Core Technologies
Analyze and Investigate
Intuitive investigations allow forensics on the fly
Active Channels for interactive investigations Dashboards with Drill-to-detail 75 Prescriptive Reports 18 Pre-built dashboards with Drill-to-detail
Powerful And Flexible Reporting
Focused Monitoring Reports Asset-based
Categorization-based
Report Scheduling Multiple Distribution Formats URL or Email Attachment
HTML, XLS, PDF, RTF, CSV Key Reporting Categories: User Login Tracking Bandwidth Usage Top Activity User Change Tracking Perimeter Security
ArcSight Express for Compliance
Correlation Rules and Reports that can map to Multiple Regulations
Coverage for SOX, PCI, HIPAA, ISO 17799, NIST, FISMA
Major focus areas derived from NIST 800-53 Guidelines Authentication Availability Workflow Attacks Access control policies Virus/Worm/Malware activity Configuration Management
Key ArcSight Express Compliance Reports
External Logins to Critical Systems Failed Database Access Logins to Email Systems Administrative Logins and Logouts by Asset Successful Brute Force Logins
Top 10 Unsuccessful Administrative Logins
Failed Anti-Virus Updates By Host Virus Summary Most Frequent 10 Targets
Device and Operating System Configuration Modifications
Real-Time Alerting
Real-time, Correlated Alerts Alert actions can be configured for Critical Events Complete Case Management Notifications Email, pager or text message delivery SNMP alerts to leverage network management response teams Notification Groups Priority Based Escalation of Notifications
Built-in Case Management
Cases and Workflow for compliance verification Cases: Create specific incidents for specific event occurrences Stages: Process cases through predefined, collaborative workflow definitions Attachments: Add additional context for incidents
Market Leading Long-term Storage
ArcSight Logger
Efficient, self-managed archiving of 8 terabytes of log data
Fast and Flexible Search Capability without traditional compromises
Raw or normalized format Automated enforcement of multiple retention policies
Data Center Rackable Appliances
Benefit: Long Term retention and Fast Search
ArcSight Express vs. The Competition
Cross Device Correlation and Reports Correlation Multi-session, asset information, moving average correlation Centralized or Distributed Collection, Secure Guaranteed event delivery Drill-downs, Active Channels from Dashboards Dynamic Rules through Session/Active Lists Lights Out Operation, Focused Management/Response UI Dedicated Design Console Robust Case Management/Workflow Notification Escalations Flex-Connector support option Future Proof Analysis from Technology Choices
? ? ?
Over a Thousand Reports Complex and Confusing Out of Box Content
10x Simple Analysis Taxonomy FEWER Reports neededwith to Categorization detect threats 10x FEWER Reports needed to detect threats Compliance Content by leveraging categorization and Network Monitoring Perimeter Compliance Content Perimeter and Network Monitoring
Compliance Content Perimeter and Network Monitoring
ArcSight Express
Competition
Rapid Implementation
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
First Boot Wizard
Connector Wizard
Network Modeling Wizard
ArcSight Express Professional Service Offering
5 days of on-site implementation services covering the following:
Appliance setup Installation of up to 8 connectors from the list of correlated event types Basic Network/Asset Modeling guidance Content tuning, as necessary Product tutorial
Additional costs items include FlexConnector development, extensive network/asset modeling work, additional content and connector deployment
ArcSight Express Deployment Options: Centralized or Distributed
Supports Many Logs and Log Formats Syslog Connector
File Based Logs ArcSight Express
3rd Party Logs
Growth Path
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
Integrated Growth Path
Databases
Sensitive Data Security
Guided Response
Users
User Activity Monitoring
ArcSight ESM
ArcSight Express
Transactions
Application Transaction Security
Infrastructure
Fraud Detection
Benefit: Common Collection, Low TCO and Seamless integration
[Link] 2009 ArcSight Confidential 33
What Makes ArcSight Unique
Unmatched in
Interoperability
Correlation
Scale
Summary
Proven, integrated technology for monitoring and controlling security and risk Designed to fit within todays IT environment while insulating tomorrows decisions Simplified form factor, easy deployment and immediately time to value
Market Share Leader
SIEM Leaders Quadrant SIX Years Running
Protect Your Business, Choose The Best
Questions?
For More Information:
ArcSight Inc.: [Link]
Webcasts: [Link]/news_webinars.htm Collateral: [Link]/[Link]
2009 ArcSight, Inc. All rights reserved. ArcSight and the ArcSight logo are trademarks of ArcSight, Inc. All other product and company names may be trademarks or registered trademarks of their respective owners.
Pre-Built Content for Top Scenarios
Cross Device Reporting
Top Bandwidth Users Configuration Changes Successful and Failed Logins Password Changes Top Attackers and Internal Targets Top Infected Systems All AV errors AV Signature Update stats Consolidated Virus Activity AV Configuration Changes
Network Devices Reporting
Network Device Errors and Critical Events Network Device Status and Down Notifications Bandwidth Usage Configuration Changes by User and Change Type Successful and Failed Logins Top Connections
Anti-Virus Reporting
VPN Device Reporting
VPN Authentication Errors Connection Counts Connection Durations Connections Accepted and Denied Successful and Failed Logins Top Connections Top Bandwidth Users VPN Configuration Changes
Database
Database Errors and Warnings Database Successful and Failed Logins Database Configuration Changes
IPS/IDS
IPS/IDS Alert Metrics Alert Counts Top Alert Sources and Destinations Top Attackers and Internal Targets
Operating System Reporting
Privileged User Administration Successful and Failed Logins Configuration Changes
Access Management
User Authentication across hosts Authentication Success and Failures User Administration Configuration Changes
Firewall Reporting
Denied Inbound Connections Denied Outbound Connections Bandwidth Usage Successful/Failed Login Activity