Event alerts
Keeping the logs is not enough: you have to notice when something happens. The event alerts of CSP (Central Syslog) read the new logs of the subscription every 3 minutes and write to you when there is something worth a look: attempts to guess a password, a sign in to the administration of a firewall at night, a configuration changed, an attack above the norm. You do not have to write rules: the predefined ones are already on.
It also helps with the NIS2 directive, which asks you to detect incidents, not only to keep the logs.
The Event alerts tile is there if the plan of the subscription includes the service. To see the page it is enough to be able to see the logs; to change rules and exceptions you need a role that lets you manage the devices.
Episodes
The events of the same rule about the same thing (an address, a user, a device, an hour) that follow one another make up an episode. For example, 34 failed sign ins in 10 minutes from the same address are one episode, not 34 alerts.
- You receive an email when the episode starts, and at most one an hour while it goes on.
- The episode ends when its events stop.
- Episodes of the last 30 days lists them, with those Going on and a link to their logs.
- The episodes of the period also appear in the reports (see Reports and analysis).
Your provider decides who receives the emails, in the notifications (see Notifications).
The rules
In Rules each rule is turned on or off (On). Those with a threshold have a Sensitivity: Low writes only for many events, High already for a few, Medium is the default. The numbers of each rule are in its description.
| Rule | When it writes |
|---|---|
| Repeated failed sign ins | Many failed sign ins in 10 minutes from the same address or for the same user: someone is trying to guess a password |
| Sign in after many failed | A successful sign in right after an episode of failed ones: the attempt may have worked |
| Access to the administration of a device | A sign in to a firewall or a router outside working hours (Monday to Friday, 8 to 19) or from an address not seen in the last 30 days. With Every access, every sign in |
| Configuration changed | A configuration of a device changed, with who and from where |
| Firmware updated | An update of the firmware of a network device |
| Accounts created or changed | A user created, deleted, locked or added to a group, a password changed |
| Audit log cleared or audit policy changed | On Windows, the security log cleared or the audit policy changed |
| Commands with sudo | A command run with sudo on a Linux server. Usually normal: off by default |
| Blocked attacks above the norm | The events blocked by the firewall in an hour, many times more than the same hour in the 14 days before |
| Attack from the internal network | Many events blocked from a private address of your network: an infected computer or a compromised device |
| VPN unstable | A VPN failing many times in an hour. An email also when it is stable again |
Press Save after the changes.
What they need to work
The rules rely on the events that the profiles recognize in the logs of your devices (see Devices and quarantine).
- A device without a profile, or read by the generic profile by words, gives no alerts.
- Imported logs, or logs arrived more than 15 minutes late, give no alerts.
Your rules
In Your rules you can add rules of your own, as many as the plan allows. Each rule has:
| Field | What to choose |
|---|---|
| Name | A name for you |
| Device | One device, or All the devices |
| Condition | The text of the log contains, The kind of event is, The user is, The source address is or The destination port is |
| Words or value | The text or the value to look for |
| More than (times in 10 minutes) | Empty: at the first event. With a number, the alert starts when the events go over that number in 10 minutes |
Then Add the rule.
The text is searched without upper and lower case, also as part of a word: "admin" finds "Administrator". A threshold counts the events of each device on its own. Unlike the predefined rules, yours also look at the logs that no profile reads.
The quickest way to make a rule is to start from a log: on the Logs page, Alert me if it repeats opens the form already filled in with the text of that log.
Examples
- An alert at every sign in of the user
adminon a device: condition The user is, valueadmin, empty threshold. - An alert when a NAS reports a failing disk: device the NAS, condition The text of the log contains, words as they appear in the log of your NAS.
Exceptions
An exception is an address, a network or a user that the rules leave out, for one rule or for all. It is for the known false alarms: the vulnerability scanner of the office, the user that runs the backups and signs in at night.
From an episode, Leave out this address adds the exception for that rule in one click.
An exception hides from the rule the events of that address, network or user for good. The logs are still kept and can be searched. Use them with care: an exception that is too wide hides real attacks too.