Beginning
In this article, various methods will be used to analyze an incident that occurred in the Incident Management department and to detect anomalies.
Behavior Analysis and Anomaly Detection
An analysis will be made regarding the event where an IP address detected by the cyber intelligence module successfully connected to an IP address in the internal network below.
Firstly, by clicking on the Magic Button located at the bottom right, which is called the action that can be taken and the tools that can be used for investigation, attached to Logsign, the tools that can be used for analysis of what actions the IP address has performed can be viewed.
When Logsign is selected in the Actions window, choose the device in the Device* field and open the Method* list. The predefined analysis queries are listed there, and the last option in the list, CUSTOM_QUERY, lets you build a customized query.
By selecting CUSTOM_QUERY, the selected IP address was set as the source IP address in the query, and the necessary columns were selected to obtain information about when it was done for the examination of the movements it made in order, which IP address and port it moved towards, and what type of movement it was. After all the operations were completed, the analysis was done by clicking the Submit button and transferred to the incident section in a short time.
As seen in the screenshot below, the analysis result shows that the relevant IP address successfully accessed the 10.10.200.10 IP address via port 443 four times.
By using the Magic Button on the investigation tools attached to Logsign, IP reputation research was conducted on AbuseIPDB, Virustotal, and IBM X-force in order.
As seen in the results, the risk scores of the relevant IP address were high in all three IP reputation tools, and it was decided to block the reported IP address with the security device, assuming that the connected server is important.