FireSIGHT System User Guide Version 5.4.1

Logging Critical Connections

License: Any

You should log connections according to the security and compliance needs of your organization. If your goal is to limit the number of events you generate and improve performance, only enable logging for the connections critical to your analysis. However, if you want a broad view of your network traffic for profiling purposes, you can enable logging for additional connections. Various settings in access control and SSL policies give you granular control over which connections you log, when you log them, and where you store the data.

In addition to the logging that you configure, the system automatically logs most connections where the system detects a prohibited file, malware, or intrusion attempt. Unless you disable connection event storage entirely using the system policy, regardless of your other logging configurations, the system saves these end-of-connection events to the Defense Center database for further analysis. All connection events reflect why they were automatically logged using the Action and Reason fields; see Action and Reason.

Security Intelligence Blacklisting Decisions (Optional)

You can log a connection whenever it is blacklisted (blocked) by the reputation-based Security Intelligence feature. Optionally, and recommended in passive deployments, you can use a monitor-only setting for Security Intelligence filtering. This allows the system to further analyze connections that would have been blacklisted, but still log the match to the blacklist. Security Intelligence monitoring also allows you to create traffic profiles using Security Intelligence information.

When you enable Security Intelligence logging, blacklist matches generate Security Intelligence events as well as connection events. A Security Intelligence event is a special kind of connection event that you can view and analyze separately, and that is also stored and pruned separately. For more information, see Logging Security Intelligence (Blacklisting) Decisions.

Encrypted Connections (Optional)

You can log a connection when the system blocks an encrypted session according to the settings in an SSL policy. You can also force the system to log connections that it passes for further evaluation by access control rules, regardless of whether you decrypt the traffic, and regardless of how the system later handles or inspects the traffic. You configure this logging on a per-SSL rule basis so that you only log critical connections. For more information, see Logging Encrypted Connections.

Access Control Handling (Optional)

You can log a connection when it is handled by an access control rule or the access control default action. You configure this logging on a per-access control rule basis so that you only log critical connections. For more information, see Logging Connections Based on Access Control Handling.

Connections Associated with Intrusions (Automatic)

When an intrusion policy invoked by an access control rule (see Tuning Traffic Flow Using Access Control Rules) detects an intrusion and generates an intrusion event, the system automatically logs the end of the connection where the intrusion occurred to the Defense Center database, regardless of the logging configuration of the rule.

However, when an intrusion policy associated with the access control default action (see Setting Default Handling and Inspection for Network Traffic) generates an intrusion event, the system does not automatically log the end of the associated connection. Instead, you must explicitly enable default action connection logging. This is useful for intrusion prevention-only deployments where you do not want to log any connection data.

For connections where an intrusion was blocked, the action for the connection in the connection log is Block , with a reason of Intrusion Block , even though to perform intrusion inspection you must use an Allow rule.

Tip To disable this connection logging on Series 3 or virtual devices, use the CLI; see log-ips-connections.

Connections Associated with File and Malware Events (Automatic)

When a file policy invoked by an access control rule detects a prohibited file (including malware) and generates a file or malware event, the system automatically logs the end of the connection where the file was detected to the Defense Center database, regardless of the logging configuration of the access control rule. You cannot disable this logging.

Note File events generated by inspecting NetBIOS-ssn (SMB) traffic do not immediately generate connection events because the client and server establish a persistent connection. The system generates connection events after the client or server ends the session.

For connections where a file was blocked, the action for the connection in the connection log is Block even though to perform file and malware inspection you must use an Allow rule. The connection’s reason is either File Monitor (a file type or malware was detected), or Malware Block or File Block (a file was blocked).

Logging the Beginning or End of Connections

License: Any

When the system detects a connection, in most cases you can log it at its beginning or its end.

However, because blocked traffic is immediately denied without further inspection, in most cases you can log only beginning-of-connection events for blocked or blacklisted traffic; there is no unique end of connection to log. An exception occurs when you block encrypted traffic. When you enable connection logging in an SSL policy, the system logs end-of-connection rather than beginning-of-connection events. This is because the system cannot determine if a connection is encrypted using the first packet in the session, and thus cannot immediately block encrypted sessions.

Note For a single non-blocked connection, the end-of-connection event contains all of the information in the beginning-of-connection event, as well as information gathered over the duration of the session.

To optimize performance, log either the beginning or the end of any connection, but not both. You can trigger correlation rules based on either beginning or end-of-connection events. Note that monitoring a connection for any reason forces end-of-connection logging; see Understanding Logging for Monitored Connections.

The following table details the differences between beginning and end-of-connection events, including the advantages to logging each.

Logging Connections to the Defense Center or External Server

License: Any

You can log connection events to the Defense Center database, as well as to an external syslog or SNMP trap server. Before you can log connection data to an external server, you must configure a connection to that server called an alert response ; see Working with Alert Responses.

Logging to the Defense Center database allows you to take advantage of many reporting, analysis, and data correlation features of the FireSIGHT System. For example:

• Dashboards and the Context Explorer provide you with graphical, at-a-glance views of the connections logged by the system; see Using Dashboards and Using the Context Explorer.
• Event views present detailed information on the connections logged by the system, which you can display in a graphical or tabular format or summarize in a report; see Working with Connection & Security Intelligence Data.
• Traffic profiling uses connection data to create a profile of your normal network traffic that you can then use as a baseline against which to detect and track anomalous behavior; see Creating Traffic Profiles.
• Correlation policies allow you to generate events and trigger responses (such as alerts or external remediations) to specific types of connections or traffic profile changes; see Creating Rules for Correlation Policies.

Note To use these features, you must log connections (and in most cases, the end of those connections rather than the beginning) to the Defense Center database. This is why the system automatically logs critical connections—those associated with logged intrusions, prohibited files, and malware.

The number of connection and Security Intelligence events a Defense Center can store depends on its model. For a list of those limits, and for information on disabling connection event storage, see Configuring Database Event Limits.

Understanding How Access Control and SSL Rule Actions Affect Logging

License: feature dependent

Every access control and SSL rule has an action that determines not only how the system inspects and handles the traffic that matches the rule, but also when and how you can log details about matching traffic.

Note Logging connections allowed by the access control and SSL policy default actions is handled slightly differently; see Logging Connections Handled by the Access Control Default Action and Setting Default Logging for Encrypted and Undecryptable Connections.

For more information, see:

• Using Rule Actions to Determine Traffic Handling and Inspection
• Using Rule Actions to Determine Encrypted Traffic Handling and Inspection
• Understanding Logging for Monitored Connections
• Understanding Logging for Trusted Connections
• Understanding Logging for Blocked and Interactively Blocked Connections
• Understanding Logging for Allowed Connections
• Disabling File and Malware Event Logging for Allowed Connections

Understanding Logging for Monitored Connections

License: feature dependent

The system always logs the ends of the following connections to the Defense Center database, regardless of the logging configuration of the rule or default action that later handles the connection:

• connections matching a Security Intelligence blacklist set to monitor
• connections matching an SSL Monitor rule
• connections matching an access control Monitor rule

In other words, if a packet matches a Monitor rule or Security Intelligence monitored blacklist, the connection is always logged, even if the packet matches no other rules and you do not enable logging on the default action. Whenever the system logs a connection event as the result of Security Intelligence filtering, it also logs a matching Security Intelligence event, which is a special kind of connection event that you can view and analyze separately; see Logging Security Intelligence (Blacklisting) Decisions.

Because monitored traffic is always later handled by another rule or by the default action, the action associated with a connection logged due to a monitor rule is never Monitor . Rather, it reflects the action of the rule or default action that later handles the connection; see Action.

The system does not generate a separate event each time a single connection matches an SSL or access control Monitor rule. Because a single connection can match multiple Monitor rules, each connection event logged to the Defense Center database can include and display information on the first eight Monitor access control rules that the connection matches, as well as the first matching Monitor SSL rule.

Similarly, if you send connection events to an external syslog or SNMP trap server, the system does not send a separate alert each time a single connection matches a Monitor rule. Rather, the alert that the system sends at the end of the connection contains information on the Monitor rules the connection matched.

Tip Even though the rule action in the connection log can never be Monitor, you can still trigger correlation policy violations on connections that match Monitor rules. For more information, see Specifying Correlation Rule Trigger Criteria.

Understanding Logging for Trusted Connections

License: feature dependent

A trusted connection is one that is handled by a Trust access control rule or the default action in an access control policy. You can log the beginnings and ends of these connections, however, keep in mind that trusted connections, regardless of whether they are encrypted, are not inspected for discovery data, intrusions, or prohibited files and malware. Therefore, connection events for trusted connections contain limited information.

Note that the system logs TCP connections handled by a Trust access control rule differently depending on the device that detected the connection:

• For Series 3 devices, TCP connections detected by a Trust rule on the first packet generate different events depending on the presence of a preceding enabled Monitor rule. If the Monitor rule is active, the system evaluates the packet and generates both a beginning and end-of-connection event. If no Monitor rule is active, the system only generates an end-of-connection event.
• For all other models, TCP connections detected by a Trust rule on the first packet only generate an end-of-connection event. The system generates the event one hour after the final session packet.

Understanding Logging for Blocked and Interactively Blocked Connections

License: feature dependent

When you log a blocked connection, how the system logs it depends on why the connection was blocked; this is important to keep in mind when configuring correlation rules based on connection logs:

• For SSL rules and SSL policy default actions that block encrypted traffic, the system logs end -of-connection events. This is because the system cannot determine if a connection is encrypted using the first packet in the session.
• For access control rules and access control policy default actions that block decrypted or unencrypted traffic (including interactive blocking rules), the system logs beginning -of-connection events. Matching traffic is denied without further inspection.

Connection events for sessions blocked by an access control or SSL rule have an action of Block or Block with reset . Blocked encrypted connections have a reason of SSL Block .

Interactive blocking access control rules, which cause the system to display a warning page when a user browses to a prohibited website, allow you to configure end-of-connection logging. This is because if the user clicks through the warning page, the connection is considered a new, allowed connection which the system can monitor and log; see Understanding Logging for Allowed Connections.

Therefore, for packets that match an Interactive Block or Interactive Block with reset rule, the system can generate the following connection events:

• a beginning-of-connection event when a user’s request is initially blocked and the warning page is displayed; this event has an associated action of Interactive Block or Interactive Block with reset
• multiple beginning- or end-of-connection events if the user clicks through the warning page and loads the originally requested page; these events have an associated action of Allow and a reason of User Bypass

Note that only devices deployed inline can block traffic. Because blocked connections are not actually blocked in passive deployments, the system may report multiple beginning-of-connection events for each blocked connection.

Understanding Logging for Allowed Connections

License: feature dependent

Decrypt SSL rules, Do not decrypt SSL rules, and Allow access control rules permit matching traffic to pass to the next phase of inspection and traffic handling.

Regardless of whether you decrypt encrypted traffic using an SSL rule, the traffic continues to be evaluated by access control rules. If you enable logging for this SSL rule, the system logs the end of matching connections, regardless of the logging configuration of the access control rules or default action that later handles them.

When you allow traffic with an access control rule, you can use an associated intrusion or file policy (or both) to further inspect traffic and block intrusions, prohibited files, and malware before the traffic can reach its final destination. Note, however, that by default file and intrusion inspection is disabled for encrypted payloads.

Connections for traffic matching an Allow access control rule are logged as follows:

• When an intrusion policy invoked by an access control rule detects an intrusion and generates an intrusion event, the system automatically logs the end of the connection where the intrusion occurred to the Defense Center database, regardless of the logging configuration of the rule.
• When a file policy invoked by an access control rule detects a prohibited file (including malware) and generates a file or malware event, the system automatically logs the end of the connection where the file was detected to the Defense Center database, regardless of the logging configuration of the access control rule.
• Optionally, you can enable beginning- and end-of-connection logging for any allowed traffic, including traffic that the system deems safe or that you do not inspect with an intrusion or file policy.

For all of the resulting connection events, the Action and Reason fields reflect why the events were logged; see Action and Reason. Note that:

• An action of Allow represents explicitly allowed and user-bypassed interactively blocked connections that reached their final destination.
• An action of Block represents a connection that was at first allowed by an access control rule, but where an intrusion, prohibited file, or malware was detected.

Disabling File and Malware Event Logging for Allowed Connections

License: Protection or Malware

Supported Devices: feature dependent

Supported Defense Centers: feature dependent

When you allow unencrypted or decrypted traffic with an access control rule, you can use an associated file policy to inspect transmitted files, and block prohibited files and malware before it can reach its destination; see Tuning Intrusion Prevention Performance. Note that because you cannot use a Malware license with a DC500, nor enable a Malware license on a Series 2 device or Cisco NGIPS for Blue Coat X-Series, you cannot use those appliances for malware protection.

When the system detects a prohibited file, it automatically logs one of the following types of event to the Defense Center database:

• file events , which represent detected or blocked files, including malware files
• malware events , which represent detected or blocked malware files only
• retrospective malware events , which are generated when the malware disposition for a previously detected file changes

If you do not want to log file or malware events, you can disable this logging on a per-access-control-rule basis by clearing the Log Files check box on the Logging tab of the access control rule editor. For information on disabling file and malware event storage entirely, see Configuring Database Event Limits.

Note Cisco recommends you leave file and malware event logging enabled.

Regardless of whether you save file and malware events, when network traffic violates a file policy, the system automatically logs the end of the associated connection to the Defense Center database, regardless of the logging configuration of the invoking access control rule; see Connections Associated with File and Malware Events (Automatic).

License and Model Requirements for Connection Logging

License: feature dependent

Because you configure connection logging in access control and SSL policies, you can log any connection that those policies can successfully handle.

Although you can create access control and SSL policies regardless of the licenses on your Defense Center, certain aspects of access control require that you enable specific licensed capabilities on target devices before you can apply the policy. Additionally, some features are only available on certain models.

Note that with a FireSIGHT license, which is included with your Defense Center, you can add host, user, and application data to the network map based on the information in connection logs, as well as view indications of compromise (IOC) information associated with connection events. Except on the DC500, you can also view geolocation data (source or destination country or continent) associated with connections.

The following table explains the licenses you must have to successfully configure access control, and therefore to log connections handled by an access control policy.

The following table explains the licenses you must have to successfully configure SSL inspection, and therefore to log connections handled by an SSL policy. Keep in mind that even if an encrypted connection is not logged (or even examined) by an SSL policy, it still may be logged for other reasons.

Logging Decryptable Connections with SSL Rules

License: SSL

Supported Devices: Series 3

Within an SSL policy, SSL rules provide a granular method of handling encrypted traffic across multiple managed devices. So that you can log only critical connections, you enable connection logging on a per-SSL-rule basis—if you enable connection logging for a rule, the system logs all connections handled by that rule.

For encrypted connections inspected by an SSL policy, you can log connection events to the Defense Center database, or to an external syslog or SNMP trap server. You can log only end-of-connection events, however:

• for blocked connections (Block, Block with reset), the system immediately ends the session and generates an event
• for monitored connections (Monitor) and connections that you pass to access control rules (Decrypt, Do not decrypt), the system generates an event when the session ends, regardless of the logging configuration of the access control rule or default action that later handles it

For more information, see Understanding How Access Control and SSL Rule Actions Affect Logging.

To log decryptable connections:

Access: Admin/Access Admin/Network Admin/Security Approver

Step 1 Select Policies > SSL .

The SSL Policy page appears.

Step 2 Click the edit icon ( ) next to the SSL policy you want to edit.

The SSL policy editor appears, focused on the Rules tab.

Step 3 Click the edit icon ( ) next to the rule where you want to configure logging.

The SSL rule editor appears.

Step 4 Select the Logging tab.

The Logging tab appears.

Step 5 Select Log at End of Connection .

Step 6 Specify where to send connection events. You have the following choices:

• To send connection events to the Defense Center, select Defense Center . When your rule action is Monitor , you must log connections to the Defense Center.
• To send events to an external syslog, select Syslog , then select a syslog alert response from the drop-down list. Optionally, you can add a syslog alert response by clicking the add icon (
); see Creating a Syslog Alert Response.

• To send events to an SNMP trap server, select SNMP Trap , then select an SNMP alert response from the drop-down list. Optionally, you can add an SNMP alert response by clicking the add icon (
); see Creating an SNMP Alert Response.

You must send events to the Defense Center if you want to perform Defense Center-based analysis on these connection events. For more information, see Logging Connections to the Defense Center or External Server.

Step 7 Click Add to save your changes.

You must apply the access control policy the SSL policy is associated with for your changes to take effect; see Applying an Access Control Policy.

Setting Default Logging for Encrypted and Undecryptable Connections

License: SSL

Supported Devices: Series 3

You can log connections for the traffic handled by the default action of your SSL policy. These logging settings also govern how the system logs undecryptable sessions.

The SSL policy default action determines how the system handles encrypted traffic that matches none of the SSL rules in the policy (except Monitor rules, which match and log—but do not handle or inspect—traffic). If your SSL policy does not contain any SSL rules, the default action determines how all encrypted sessions on your network are logged. For more information, see Setting Default Handling and Inspection for Encrypted Traffic.

You can configure the SSL policy default action to log connection events to the Defense Center database, or to an external syslog or SNMP trap server. You can log only end-of-connection events, however:

• for blocked connections (Block, Block with reset), the system immediately ends the sessions and generates an event
• for connections that you allow to pass unencrypted to access control rules (Do not decrypt), the system generates an event when the session ends

Note that even if you disable logging for the SSL policy default action, end-of-connection events may still be logged to the Defense Center database if the connection previously matched at least one SSL Monitor rule, or later matches an access control rule or the access control policy default action.

To set the default handling for encrypted and undecryptable traffic:

Access: Admin/Access Admin/Network Admin/Security Approver

Step 1 Select Policies > SSL .

The SSL Policy page appears.

Step 2 Click the edit icon ( ) next to the SSL policy you want to edit.

The SSL policy editor appears, focused on the Rules tab.

Step 3 Click the logging icon ( ) next to the Default Action drop-down list.

The Logging pop-up window appears.

Step 4 Select Log at End of Connection to enable logging connection events.

Step 5 Specify where to send connection events. You have the following choices:

• To send connection events to the Defense Center, select Defense Center .
• To send events to an external syslog server, select Syslog , then select a syslog alert response from the drop-down list. Optionally, you can configure a syslog alert response by clicking the add icon (
); see Creating a Syslog Alert Response.

• To send events to an SNMP trap server, select SNMP Trap , then select an SNMP alert response from the drop-down list. Optionally, you can configure an SNMP alert response by clicking the add icon (
); see Creating an SNMP Alert Response.

You must send events to the Defense Center if you want to perform Defense Center-based analysis on these connection events. However, note that traffic handled by the SSL policy default action is not further inspected for intrusions, malware, or discovery data. For more information, see Logging Connections to the Defense Center or External Server.

Step 6 Click OK to save your changes.

You must apply the access control policy the SSL policy is associated with for your changes to take effect; see Applying an Access Control Policy.

Logging Connections Matching an Access Control Rule

License: Any

To log only critical connections, you enable connection logging on a per-access-control-rule basis. If you enable logging for a rule, the system logs all connections handled by that rule.

Depending on the rule action and intrusion and file inspection configuration of the rule, your logging options differ; see Understanding How Access Control and SSL Rule Actions Affect Logging. Also, note that even if you disable logging for an access control rule, end-of-connection events for connections matching that rule may still be logged to the Defense Center database if the connection:

• contains an intrusion attempt, prohibited file, or malware
• was inspected and logged by an SSL policy
• previously matched at least one access control Monitor rule

To configure an access control rule to log connection, file, and malware information:

Access: Admin/Access Admin/Network Admin

Step 1 Select Policies > Access Control .

The Access Control Policy page appears.

Step 2 Click the edit icon ( ) next to the access control policy you want to modify.

The access control policy editor appears, focused on the Rules tab.

Step 3 Click the edit icon ( ) next to the rule where you want to configure logging.

The access control rule editor appears.

Step 4 Select the Logging tab.

The Logging tab appears.

Step 5 Specify whether you want to Log at Beginning of Connection or Log at End of Connection .

To optimize performance, log either the beginning or the end of any connection, but not both.

For a single non-blocked connection, the end-of-connection event contains all of the information in the beginning-of-connection event, as well as information gathered over the duration of the session. Because blocked traffic is immediately denied without further inspection, you can log only beginning-of-connection events for Block rules.

Also note that because the purpose of a Monitor rule is to log matching traffic, end-of-connection logging to the Defense Center database is auto-enabled and you cannot disable it. For more information, see Logging the Beginning or End of Connections.

Step 6 Use the Log Files check box to specify whether the system should log any file and malware events associated with the connection.

The system automatically enables this option when you associate a file policy with the rule to perform either file control or AMP. Cisco recommends you leave this option enabled; see Disabling File and Malware Event Logging for Allowed Connections.

Step 7 Specify where to send connection events. You have the following choices:

• To send connection events to the Defense Center, select Defense Center . You cannot disable this option for Monitor rules.
• To send events to an external syslog server, select Syslog , then select a syslog alert response from the drop-down list. Optionally, you can add a syslog alert response by clicking the add icon (
); see Creating a Syslog Alert Response.

• To send events to an SNMP trap server, select SNMP Trap , then select an SNMP alert response from the drop-down list. Optionally, you can add an SNMP alert response by clicking the add icon (
); see Creating an SNMP Alert Response.

You must send events to the database if you want to perform Defense Center-based analysis on connection events. For more information, see Logging Connections to the Defense Center or External Server.

Step 8 Click Save to save the rule.

Your rule is saved. You must apply the access control policy for your changes to take effect; see Applying an Access Control Policy.

Logging Connections Handled by the Access Control Default Action

License: Any

You can log connections for the traffic handled by the default action of your access control policy. The default action determines how the system handles traffic that matches none of the access control rules in the policy (except Monitor rules, which match and log—but do not handle or inspect—traffic); see Setting Default Handling and Inspection for Network Traffic.

The mechanisms and options for logging connections handled by the policy default action largely parallel the options for logging connections handled by individual access control rules, as described in the following table. That is, except for blocked traffic, you can log the beginning and end of connections, and you can send connection events to the Defense Center database, or to an external syslog or SNMP trap server.

However, there are some differences between logging connections handled by access control rules versus the default action:

• The default action has no file logging options. You cannot perform file control or AMP using the default action.
• When an intrusion policy associated with the access control default action generates an intrusion event, the system does not automatically log the end of the associated connection. This is useful for intrusion detection and prevention-only deployments, where you do not want to log any connection data.

An exception to this rule occurs if you enable beginning-of-connection logging for the default action. In that case, the system does log the end of the connection when an associated intrusion policy triggers, in addition to logging the beginning of the connection.

Note that even if you disable logging for the default action, end-of-connection events for connections matching that rule may still be logged to the Defense Center database if the connection previously matched at least one access control Monitor rule, or was inspected and logged by an SSL policy.

To log connections in traffic handled by the access control default action:

Access: Admin/Access Admin/Network Admin

Step 1 Select Policies > Access Control .

The Access Control Policy page appears.

Step 2 Click the edit icon ( ) next to the access control policy you want to modify.

The access control policy editor appears, focused on the Rules tab.

Step 3 Click the logging icon ( ) next to the Default Action drop-down list.

The Logging pop-up window appears.

Step 4 Specify whether you want to Log at Beginning of Connection or Log at End of Connection .

To optimize performance, log either the beginning or the end of these connections, but not both. For a single non-blocked connection, the end-of-connection event contains all of the information in the beginning-of-connection event, as well as information gathered over the duration of the session. Because blocked traffic is immediately denied without further inspection, you can log only beginning-of-connection events for the Block All Traffic default action.

Step 5 Specify where to send connection events. You have the following choices:

• To send connection events to the Defense Center, select Defense Center . You cannot disable this option for Monitor rules.
• To send events to an external syslog server, select Syslog , then select a syslog alert response from the drop-down list. Optionally, you can add a syslog alert response by clicking the add icon (
); see Creating a Syslog Alert Response.

• To send events to an SNMP trap server, select SNMP Trap , then select an SNMP alert response from the drop-down list. Optionally, you can add an SNMP alert response by clicking the add icon (
); see Creating an SNMP Alert Response.

You must send events to the database if you want to perform Defense Center-based analysis on connection events. For more information, see Logging Connections to the Defense Center or External Server.

Step 6 Click Save to save the policy.

Your policy is saved. You must apply the access control policy for your changes to take effect; see Applying an Access Control Policy.