As we know, the construction of a security operations center (SOC) has many moving parts. From a technological point of view, it is very important to have open source to identify threats and reduce costs. From a DiD (defense in depth) point of view, there are many devices and technologies that must be used to create the SOC. Based on the industry experience below, the technologies can be used to create an appropriate SOC to monitor threats and detect anomalies to protect business.
Mainly, since most attacks come from outside, it is very important to use appropriate controls at the perimeter of the network. By using open source products, we can reduce the cost of the product and support is not essential.
Here are the Best SOC Monitoring Tools
1. IDS / IPS: Snort
The intrusion detection system is very important and is necessary to monitor traffic in order to identify or detect anomalies and attacks. Snort is one of the open source intrusion detection / prevention systems that can perform real-time traffic analysis with packet logging on Internet protocol networks. Snort has 5 important components that help detect attacks.
Packet decoder
Preprocessors
Detection mechanism
Recording and alert system.
Output modules
Using the above components, Snort can detect attacks or probes based on the network, including fingerprint attempts of the operating system, semantic URL attacks, buffer overflows, SMB (Server Message Blocks) and stealth port analysis . It can also detect attacks on web applications, such as SQL injections.
Since Snort is just a mechanism, it requires a graphical interface for easy use, if you are not familiar with the command line, so setting up Snorby is good and it also requires a normal web server application like Apache.
Part of Snort's value is that it can be configured in three different modes: as a network sniffer, packet recorder, or full IDS. As such, it can be at the heart of an automated security system or component along with a variety of commercial products.
2. Vulnerability scanner (OpenVAS)
To be a type of proactive security, it is very important to have a vulnerability scanner to analyze and confirm whether assets are working with critical vulnerabilities that could lead to a security breach or an attack. The Vulnerability Scanner is a product that has several updated scripts that are useful for identifying vulnerabilities in the system or in applications. Regularly check systems, especially external systems or systems connected to the Internet, and make regular corrections.
Tip: For each update or deployment, it is mandatory to ensure that all systems or applications are corrected for existing vulnerabilities.
There are several open source tools with limited licenses, such as OpenVAS. Regular NVT updates are useful for detecting emerging vulnerabilities.
The OpenVAS engine can be used with the Greenbone and Barnyard GUI database to complete the results in the user interface. You can verify the entire system over the network and it is nice to have authenticated verification with domain credentials. Greenbone offers options for creating credentials, hosts, tasks and schedules in the user interface.
3. Nagios
Nagios monitors the network: infrastructure, traffic, and connected servers are part of their basic or extended resources. Like many other open source packages, Nagios is available in free and commercial versions.
Nagios Core is at the heart of the open source project, based on the free open source version. Individual products can be monitored and individual tasks can be done through plugins; There are about 50 "official" plugins developed by Nagios and over 3000 plugins provided by the community.
The Nagios user interface can be changed via an interface to the desktop, web or mobile platform, and configuration can be managed with any of the configuration tools available.
4. Maltego
Maltego is proprietary software used for open source intelligence and forensic analysis, developed by Paterva. Malteg focuses on providing a transform library for uncovered data sources and visualizing this information in a graphical format suitable for link analysis and data mining.
5. Vega
Vega is a free, open source web security scanner and web security platform for testing the security of web applications. Vega can help you find and validate SQL injection, online scripts (XSS), confidential information unintentionally revealed and other vulnerabilities. It is written in Java, based on a graphical interface and works under Linux, OS X and Windows.
