The Easiest

Solution for
Next-Generation SIEM

SureLog
International
Edition

w w w.anetusa .net
 ANET
SURELOG

011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
ANET SURELOG MAIN ADVANTAGES The products

* Forensic capabilities
* Correlation engine
* Performance
* Machine Learning
* Dashboards Incident response
* Compliance Reporting
* Scalability Log compatibility
* Taxonomy module
* Threat Intelligence

Scalability:

SureLog can scale into any organization — big or small, locally based or operating
globally. ANET SureLog “Hierarchical Master-Slave Model” manage events in a distrib-
uted manner for offloading the processing requirements of the log management
system for tasks such as collecting, filtering, normalization, aggregation.
This model also is solution for security related issues and incremental approach.
The main advantage of “Hierarchical Master-Slave Model” is easily extendable and
scalable by adding regional SIEM implementations.

Log compatibility:

SIEM functions based not just on its correlation rules but on the data you feed it.
* The more sophisticated correlation engine than the other competitive Feeding your SIEM security-related data results in more accurate alerts.
products. If there is a log format that is not supported, there is an API for custom log parser.
SureLog has nearly 500+ supported device.
* Advanced rules
* Visual rule editor Dashboards:
* Creating rules from the dynamic lists
* Updating the global lists dynamically Real-Time monitoring and dashboards permits visibility at the desired level via
* Rule suspending security-based, pre-defined and customizable analysis.
* Time based rules In addition, you can create real time and easy reports by preparing dashboards and
* Automatic actions to a triggered correlated event widgets which are appropriate for your new ad hoc requirements.
* Big Data The SureLog application features dashboards on various security topics.
* Distributed architecture Dashboards deliver monitoring and reporting metrics to track the state of security
throughout the network.
These are simple to configure and user friendly, while allowing users to read a
summary of existing network infrastructure data using graphs and tables.

SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
3
Threat Intelligence
Compliance Reporting

Regulatory compliance is necessary. SIEM will help to save time and ensure com-
pliance with predefined reports. Creating a productive SIEM environment requires
plenty of predefined reports you need on a daily, weekly or monthly basis and also
easy to create reporting infrastructure SureLog has more than 1400 predefined
reports and very easy &fast reporting infrastructure.

Incident response

Incident response is an action that SIEM takes in response to suspicious activity or

an attack. Active response actions include the Block IP active response, the Disable
Networking active response, the Log off User active response, the Kill Process
active response and so on. SureLog also supports to execute any executable file as a
response with parameters from detection rules

Machine Learning
Threats are dynamic and attack vectors change constantly.
Respond quickly and minimize damage by using the rich external context Machine learning in SIEM takes cybersecurity rules and data to help facilitate security
enabled by threat intelligence. Immediately know about dangerous IP address- analytics. As a result, it can reduce the effort or time spent on rote tasks or even
es, files, processes, and other risks in your environment. SureLog combines more sophisticated duties. With the right configurations, machine learning can actual-
multiple threat intelligence feeds and generates alerts for the benefit of the ly make decisions based on the data it receives and change its behavior accordingly.
security team. SureLog uses this data to educe false-positives, detect hidden SureLog has many ML models. Some of the ML models used by SureLog.
threats, and prioritize your most concerning alarms.
· Detecting tools used by cyber criminals
· Hunting critical process masquerade
· Hunting malware and viruses by detecting random strings
· Domain generation algorithm (DGA) detection
· Profiling user and entity behaviour
SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
4
Performance

The performance analyses of SIEM products are very important in terms of evaluation.
The running performance of SIEM products, the resources which they require (CPU, RAM, DISK) and how they will show performance in the EPS value needed is very
important.

SureLog has the best SIEM performance especially CPU, RAM, and Disk performance

Forensic capabilities

Almost every company needs a solution for protecting its sensitive data and detecting suspicious activity in real time. Besides, when an incident occurs, companies
want to be able to provide digital evidence in the courtroom. Integrity also critical. This is usually achieved by using integrity mechanisms, such as running hash checks
on blocks of stored log data. Historical log data must be secured either with a checksum in the form of a popular hash — MD5, SHA1, SHA2, etc. — or with a digital
signature. Easily aggregate and search logs within a single platform is critical. SureLog compresses indexes. Compressing indexes give SureLog the advantage of live
search, real-time search capability for years. An example of a SureLog disk capacity requirement of a live search for 5000 EPS for one year is 5 GB. SureLog live search
disk usage performance is the best among competitors. When SureLog disk usage for live search compares to Elasticsearch and Lucene based systems, the result
depicted in the below graph. It is shown that SureLog compress much more than Elasticsearch and Lucene.

SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
5
 CORRELATION

011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
SIEM use cases or rules are the %80 of the value of the product. A Next-Gen SIEM correlation engine will be very helpful to analysts indeed.
Not all SIEM correlation rules, use cases are created equal and it is hard to find a SIEM that supports both core, advanced and intelligent use cases at an affordable
price. All the SIEM products have correlation but not all SIEM solutions are created equal. Detailed analysis required to understand the difference of correlation capabili-
ties. For example, most of the SIEM solutions have watchlist or list management feature, but SureLog has multidimensional list management capability in correlation.
Correlation and detection methods and correlation features diversity are important like detecting what never seen before and many others.
SureLog can play a huge role in making analysts’ jobs easier with many modern detection and correlation features like never seen before type of rules

SureLog SIEM rule type examples:

· Never seen type of rules

· Trend rules
· UBA rules
· Anomaly detection rules
· Change comparison rules
· List management
· Taxonomy rules

Sample distinguishing use cases supported by SureLog:

• Returns days where a user accessed more than his 95th percentile number of assets
• Look for a user whose HTTP to DNS protocol ratio is %300 more than %95 of the other users for the last four-week ratio for 4th day of week
• If a user number of failed authentication ratio to number of successful authentication is %10, alert
• Data loss detection by monitoring all endpoints for an abnormal volume of data egress
• Measures the similarity between well-known process names with the running ones using Levenshtein distance in real-time and detect process masquerade
• DGA detection
• Failed logon to an asset that a user has previously never logged on to
• First time user is performing an activity from a country
• First VPN connection from a device for a user
• First connection from a source IP
• First access to a device for a user
• First access to database MSSQL for peer group HR
• First access to database MSSQL for user
• First mail to/from a domain for the organization
• First access to this web domain which has been identified as risky by a reputation feed
• First execution of a process on a host
• First access to object fdghsdydhas
• First access from a host to a database for a user
• First access from source zone Atlanta office to a database for a user
• Suspicious temporary account activity
• Abnormal account administration
• Unusual account privilege escalation
• Unusual file modifications
• Abnormal password activity

SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
7
 SURELOG
SIEM AND
ADVANCED
THREAT
DETECTION

011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
SureLog SIEM comes with advanced correlation engine, behavioral analytics
and Machine Learning (ML) models to automate pattern discovery while
facilitating intelligent rule creation.

As a subfield of Artificial Intelligence (AI), SureLog’s ML uses algorithms to

find patterns in data and models them to detect anomalous behavior of users
and entities. SureLog’s machine learning library, pre-packaged with over 1,000
models and correlation rules, enables organizations to better identify advanced
persistent threats (APTs) that have previously been flying under the radar.

SureLog SIEM Federated Anomaly Detection Engine Using

Classification Domain Generation Algorithm (DGA) Detection in SureLog
Next generation detection engine of SureLog SIEM combining rule based and DNS is probably the best source of data for detecting an attacker’s command and
Machine Learning (ML) based techniques. SureLog utilizes machine learning control activity, which can be isolated by looking at outbound DNS requests.
models and advanced correlation rules together and dynamically update each Botnets play an important role in malware distribution and they are widely used for
of them. spreading malicious activities in the Internet.

Identifying algorithmically generated domains in network traffic is a key aspect for

analyzing, detecting and mitigating botnet behavior

Hunting Critical Process Masquerade Using SureLog SIEM

Anomaly detection with SureLog infers a probabilistic model for the network
behaviors of each IP address. Each network event is assigned an estimated
probability (henceforth, the event’s “score”). Those events with the lower
scores are flagged as “suspicious” for further analysis.

SureLog utilizes Linear Discriminant Analysis (LDA) as classifier.

User and Entity Profiling with SureLog

A popular technique for hiding malware running on operating systems is to give it a
Organizations need to guard against not only outsider cyber criminals but name that’s confusingly similar to a legitimate operating system process, preferably
also rogue insiders. To effectively deal with insider threats, a layered security one that is always present on all systems. Processes whose names are confusingly sim-
approach leveraging both preventive and detective security controls should ilar to those of critical system processes are likely to be malicious. Malicious process
be in place. SureLog focuses on insider threats, such as employees who have detection using process name is critical.
already been compromised or malicious employees who have gone corrupt and
carry out targeted attacks.

SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
9
Hunting Malware and Viruses by Detecting Random Strings Cyber Criminals are using various malicious tools for cyber-attacks based on the
Using SureLog SIEM target’s strength to infiltrate the sensitive data and more often nowadays Publicly
Available Hacking Tools are mainly used by threat actors for various attacks around
the world. Here we can see the most used top 4 publicly available hacking tools by
threat actors:

* China Chopper
* Mimikatz
* PowerShell Empire
* HUC PacketTransmitter

Those tools are well-known type of

* Webshells
* Credential Stealers
* Lateral movement frameworks
* Command and control (C2C) obfuscators
There are malware tools available that can create Windows services with
random service names and descriptions. Emotet infection is an example of Large Scale SureLog SIEM Implementation
malicious services created on the machine. This is due to how Emotet installs
itself on a machine, creating randomly named numeric services, which in turn Today’s computer networks produce a huge amount of security log data. The security
try to run another randomly named executable in “C:\Windows” The example event correlation scalability has become a major concern for security analysts and
below shows four Emotet services (other may have more) that have been IT administrators when considering complex IT infrastructures that need to handle
created on an infected machine. huge amount of security log data. The current correlation capabilities of Security
Information and Event Management (SIEM), based on a single node in centralized
servers, have proved to be insufficient to process large event streams.

Figure 1. Malicious Service

DETECTING TOP 4 TOOLS USED BY CYBER CRIMINALS

RECENTLY WITH SURELOG

SureLog
Next-Generation SIEM
011011100000101010111110000000000100101010010010101010101000010101010010101010101010101011100000100010010010100101110010010101010101010101000010010101010100001
01000001111100010101010100010000100010000100010011010101010101010101010101010100100001001000010000000001010011010010001000100001001010001000100001001001010
101010110100100000010010101010100100100010010100000011111100010001001001010101010101000100101010001001000100100010001001001010010101010101011010101010101010101
01010101010101010001000101001001010101010101000010011010111100010010001000010111100100100010001001000100010001001011001010101010101000010100101010010001010010
10001001001000010001010101010101001001010111110000001000100010101010101010101010101001010111111010101010101000010010101010101010101010101010101010100010001001010
10