LEM use cases

Hi all,

I'm new with LEM and consider it as a central console for future SOC in my current company

I just want to leave here my list of use cases and share in a future "how to" realize them

Don't hesitate to share your use cases (and description how you implemented them) that can be useful for community

I'd be glad to discuss this topic as detailed as possible

So, my list (is updating):

Encryption

1. Encryption traffic identified (List of sources that are allowed to receive encryption traffic is needed)
2. SSL-certificate of web-site XXX is expired soon
3. Remote user (VPN) is trying to use expired SSL-certificate

User activity monitoring

1. Any activity after working hours
2. New user created (OS/Application/Device): Who (admin/service account name) / where 'who' account created new user (AD, app etc.) / Date:Time when 'who' account entered to the 'where' / Connection type to 'where' (intranet, VPN) / IP:DNS:OS of remote host that was used to connect to 'where' / Object that was read:modified / What exactly was entered / Date:Time of exit:disconnection
3. User added into Administrative group
4. User changed his password very soon (X days after last change)
5. User changed his password during virus/DDos/etc/ attack
6. User privileges were changed
7. User was deleted
8. Unsuccessful Logon is more then X times per minute
9. Unsuccessful Logon with expired/blocked credentials is more then X times per minute
10. Successful root (Unix OS) Logon
11. Root: Logging every command / shell command
12. Logon without AD/Radius/Kerberos etc. (e.g. local accounts)
13. Unregistered external device connected
14. Workstation Logon under one account and then logon to the target system under another (e.g. login attempt not under the account from the list of admins)
15. Connection via VPN under one account and further access to the target system under another one
16. Attempt to connect a user to a website with a low reputation
17. Running TeamViewr-like connection (notification before connection is established). Attempting to connect to specific ports (TeamViewer = 5938)
18. Similar account login from different geographical places
19. Multiple login failures from the same username ip address to the same destination and followed by success
20. If on leave/ex-employee user credentials have been used in anyway
21. Often use admin accounts logon on the same host
22. Sudo actions (“sudo: … COMMAND=…” “FAILED su”)
23. Service failure (“failed” or “failure”)
24. Changing the user certificate
25. Authentication with a revoked certificate
26. User left an office but his account is in use

Information systems

1. Start, stop or pause logging of events on each IS
2. Create or delete system-level objects, such as database tables or stored procedures
3. Changing the integrity of files and detecting changes to the event logs
4. Changing the configuration of the OS and / or service
5. The time difference between NTP1 and NTP2 compared to an external source is greater than X s
6. NTP1 / 2 became inaccessible to host
7. Integration with vulnerability scanners
8. Increased viral activity -> active sessions on the IP
9. Exceeding the average load of external channels by 10%
10. Excess of the average antivirus response rate for a certain period
11. The rule is triggered on IDS / IPS
12. XSS Attacks identified
13. SQL injection identified
14. Hostile email attachments identified
15. Restart/Shutdown critical servers
16. Any config changed
17. LEM Agent has been tampered
18. If an infected machine receives an SSH log in attempt
19. What recent servers were attacked with an exploit against a recent scan of the same server
20. OS fingerprint event has occurred by an attacker
21. Auditing has been removed, changed or altered
22. Access to any device from other than the admin or authorized users
23. if the firewall has critical policy change (now this differ from one brand to another as you might not find the same naming of the event in all brands the same)
24. If x number of changes have been made on a firewall over x period of time by x user
25. If machine's time has changed
26. Track on each new virus detected on the environment

Networks

1. Channels between sites went down
2. Unsuccessful attempts to connect to a VPN hub
3. Attempts to break into L2VPN / IPSec tunnels
4. Network scanning (nmap, scanners, bruteforce, epidemics, DDOS, etc.)
5. Mass attempts to connect to IS from an untrusted network
6. Mass attempts to connect to IP with IP not from the whitelist
7. Installing a VPN connection from untrusted countries
8. Changing the configuration of network equipment
9. Ping Sweep
10. If a new port has opened on the firewall for in/out traffic
11. If FTP site has been accessed from unknown address
12. If tunneled data is detected on the network
13. If RAR files are being continuously uploaded in some fixed partition size format
14. If online messengers are used to chat and transfer files
15. If malicious traffic is seen hitting critical servers of the infra
16. detecting bit torrent or P2P traffic
17. If a remote session was taken to a critical server for more than an hour
18. Network resources have been accessed in non working hours
19. taking sessions ssh, telnet etc on non standard port
20. Attacks on internet gateways
21. Bandwidth and protocol usage (“limit … exceeded”, “CPU utilization”)
22. Detected attack activity (“attack from”)
23. Administrator access (“AAA user …”, “User … locked out”, “login failed”)