Network Detection and Response User Guide – Investigations
The Network Detection and Response Module contains preset investigations to help an analyst quickly gain visibility into any suspicious or malicious activity in their environment, as well as policy violations and operations info. This section details all of the investigations included in the module, including any additional configuration notes.
Network: Unauthorized/Risky Application Usage
Investigation ID: 205
An organization can decide if certain network applications should not be used within its network. This could cover both misuse and security concerns.
Minimum Log Sources
LogRhythm Network Monitor
Recommended Log Sources
LogRhythm Network Monitor
Configuration
Populate the Network: Unauthorized/Risky Applications list with applications that are disallowed.
Actions
- Analyze the application traffic to determine if its usage stems from misuse or a possible infection.
- Investigate the host for additional information.
Network: Blacklisted Country Activity
Investigation ID: 206
Although many organizations are multinational and regularly have connections to external countries, connections from countries that don't have an organizational presence should be suspicious. An Organization can predefine these countries in a blacklist. This investigation will show network communication with countries in this list.
Minimum Log Sources
Firewall or Flow data
Recommended Log Sources
- LogRhythm Network Monitor
- Next-Generation Firewall
Configuration
Populate the Network: Blacklisted Countries list with the set of countries that should not have communication with your organization.
Actions
- Investigate the connections and traffic going to the blacklisted country. Certain hosts and protocols, such as a typical user on web traffic to port 80, are probably not a major concern. Others, like SSH from a web server, will be more significant.
- If the connection and host pair seem suspicious, investigate the host to determine if it has been compromised.
Network: Non-Whitelisted Country Activity
Investigation ID: 207
Although many organizations are multinational and regularly have connections to external countries, connections from countries that don't have an organizational presence should be suspicious. An Organization can predefine acceptable countries in a whitelist. This investigation will show network communication with countries that aren’t in this list.
Minimum Log Sources
Firewall or Flow data
Recommended Log Sources
- LogRhythm Network Monitor
- Next-Generation Firewall
Configuration
Populate the Network: Whitelisted Countries list with the set of countries with which the organization should exclusively communicate.
Actions
- Investigate the connections and traffic going to the non-whitelist country. Certain protocols, such as web traffic to port 80 are probably not a major concern. Others, like SSH, will be more significant.
- If the connection and host pair seem suspicious, investigate the host to determine if it has been compromised.
Network: Non-HTTP Traffic Over Port 80
Investigation ID: 208
To hide command and control communication among legitimate traffic, malicious implants may use standard protocol ports even if their covert channels don't conform to protocol standards. This could also be an attempt to circumvent a firewall. Because LogRhythm Network Monitor can accurately identify protocols without relying solely on ports, it is able to detect port misuse by such malware.
Minimum Log Sources
Firewall or Flow data
Recommended Log Sources
LogRhythm Network Monitor, Next Generation Firewall
Tuning
If a legitimate application is found, add it to the Network: Search: HTTP list to eliminate future false positives.
Actions
- Using Network Monitor, analyze the traffic to see if it is malicious. It might just be an application that happens to use port 80 to get around a firewall.
- If the traffic appears suspicious, investigate the host for other indicators of compromise.
Network: Network Monitor Activity Past 30 Minutes
Investigation ID: 209
When investigating a host for signs of suspicious activity, it can be useful to see all network traffic for that host. Customize this Investigation by adding New Field Filters for specific hosts. This Investigation can also be customized by included filters based on any additional LogRhythm field. For example, find all network traffic for an application, user, or country.
Minimum Log Sources
LogRhythm Network Monitor
Recommended Log Sources
LogRhythm Network Monitor
Configuration
In the Investigation selection window, single-click this Investigation and then Next. Once on the Specify Event Selection window, use the Add New Field Filter dropdown box to select additional query criteria.
Actions
Using this Investigation is dependent on what additional filters were used.