Event Mapping is a mechanism that allows you to add data to an event by using data already in the event to reference and pull in data from an outside source. The outside data source is a map, which is defined using the Mapping Tab. The data already in the event that should be used as the reference into the map and the data to be pulled from the map into the event are specified using the Events Tab.
Since virtually any data set can be made into a map, Event Mapping is useful for incorporating into the event stream data from elsewhere in your organization. Some opportunities Event Mapping provides are:
Regulatory Compliance monitoring
Policy compliance
Response prioritization
Enable security data to be analyzed related to business operations
Enhance accountability
When an Event Mapping is defined, it is applied system-wide to all events from all Collectors. Additionally, Sentinel will automatically distribute map data to all processes that perform event mappings as well as keep the map data in these processes up-to-date. For these reasons, Event Mapping provides significant capabilities to support enterprise deployments.
Event Mapping comprises of four main parts:
Controller: Stores all map information
Distributor: Automatically redistributes modified maps to those processes that registered for the map
Monitor: A monitor to detect changes in map source data
Generator: Generates maps from source data
One application of Event Mapping is Sentinel's Asset Data functionality. For example, asset information is collected and stored in the Sentinel Database asset schema and is represented by a Physical Asset Entry. Soft assets, such as services and applications, are represented by an entry that is linked to a Physical Asset. The primary automated update mechanism for asset data is through an asset Collector reading data from a scanner such as Nmap. The asset Collector automates the retrieval of asset information by reading asset data from the scanner and populating the asset schema tables with this data. For Event Mapping, asset information is mapped from the destination IP and source IP.
There are two types of data sources:
External: A Collector populates that value in the event tag.
Referenced from Map: Data is retrieved from a map to populate the tag.
In the above illustration, the SourceAssetName tag is populated from the map called Asset (which has asset.csv as its map data source file). The specific value for SourceAssetName is taken from the AssetName column from the Asset map. The PhysicalAsssetName column is set as the key. When the SourceIP tag of the event matches one of the source IP values in the PhysicalAsssetName column of the map, the row with the matching key is used to intersect the AssetName Column. For instance, in the below example IP 198.168.1.100 corresponds to AssetName Finance35.
NOTE: When a column is set as a key, it will not appear in the Column drop down field.
You may have more than one column set as a key as you do not want the map to be a Range Map (Range Maps can only have one key column, with that column type set to NumberRange). For instance (with column type set to String) the AttackId tag has the DeviceName (name of the security device) and DeviceAttackName columns set as keys and uses the NormalizedAttackID column in the AttackNormalization map for its value. In a row where the DeviceName event tag matches the data in Device map column and the DeviceAttackName matches the data in the AttackSignature map column, the value for AttackId is the value in the NormalizedAttackID column. The configuration for Event Mapping just described is:
To Configure Event tags (columns) to use Mapping:
Navigate to Admin tab and click Event Configuration in the navigation pane or click Event Configuration button.
Highlight an event tag entry from the Event Columns list.
NOTE: The original Event Tag name appears above the Label field. In addition, the description of the event column is provided.
Click Referenced from Map to configure the event tag to be populated with data from a map. Click External to keep whatever value the Collector put in the event tag (if any).
Click the Map Name field down arrow.
Select one of the following default maps or a map you have created:
Asset: Contains the data from the map data source file asset.csv. The asset.csv is automatically generated from asset data from Sentinel Database when an asset Collector is run. This file could be populated manually instead, if desired.
AssetToRegulation: Contains the data from the map data source file AssetToRegulation.csv. This file must be populated manually.
AttackSignatureNormalization: Contains the data from the map data source file attackNormalization.csv (IDS signatures). The attackNormalization.csv file is automatically generated from Advisor data from Sentinel Database when an Advisor feed is completed.
IpToCountry: Contains the data from the map data source file IpToCountry.csv. This file must be populated manually.
IsExploitWatchlist: Contains the data from the map data source file exploitDetection.csv (vulnerabilities and threats). The exploitDetection.csv file is automatically generated from Advisor and Vulnerability data from Sentinel Database when either an Advisor feed is completed or a vulnerability Collector is run.
Click the Map Column field down arrow and select a Map Column name. Depending on your Map Name choice in the previous step, these values will vary.
|
|
_EXIST_ : This is a special Map Column that exists in every map. If this Map Column is selected, a "1" will be put in the event tag if the key is in the map data. If the key is not in the map data, a "0" will be put in the event tag.
All other choices: Names of active columns within the map definition that are not set as a key (e.g., CustomerId column in Asset or NormalizedAttackId column in AttackNormalization)
In the Key Configuration, for each row in the table select the event tag in the Event Tag column that will be matched against the map key column specified in the corresponding Map Key Field column. The rows in the Key Configuration table will depend on the Map Name selected.
NOTE: A key is a unique identifier for the row of data in the map data.
Click Apply.
NOTE: Clicking Apply saves the changes you made for the currently selected event column in a temporary buffer. If you don't click Apply, when you select a different event column the changes you made to the previously selected event column are lost. Changes won't be saved to the server until you click Save.
If you would like to edit the Event Mapping of another Event column, repeat the steps above. Remember to click Apply after editing the Event Mapping of each Event column.
Click Save.
NOTE: Clicking Save will save your changes to the server. The save function saves all changes stored in the temporary buffer (when you clicked Apply).