Security information and event management
View Patent ↗Systems and methods are described for conducting work flows by an SIEM device to carry out a complex task automatically. According to one embodiment, an SIEM device may create a work flow that includes multiple security tasks that are performed by one or more security devices. When a security event is captured or the work flow is scheduled to be executed, the SIEM device starts the work flow by scheduling the security tasks defined in the work flow. The SIEM device then collects results of security tasks performed by the one or more security devices.
1. A method comprising:
starting, by a security information and event management (SIEM) device associated with a private network, a work flow instance by
deriving said work flow instance from a work flow template, including translating information contained within the work flow template, defining a plurality of security tasks at an abstract level, into commands and parameters (i) for accomplishing the plurality of security tasks by a plurality of security devices from at least two different manufacturers and (ii) that are specific to the plurality of security devices, wherein the plurality of security devices are associated with the private network and managed by the SIEM device, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks; and
scheduling the plurality of security devices to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the plurality of security devices through a device adapter layer implemented by the SIEM device; and
collecting, by the STEM device, results of the plurality of security tasks after they are performed by the plurality of security devices.
2. The method of claim 1 , wherein the work flow template is imported from another SIEM device.
3. The method of claim 1 , further comprising creating, by the STEM device, the work flow template.
4. The method of claim 1 , wherein the plurality of security tasks are performed serially.
5. The method of claim 4 , further comprising determining if a security task of the plurality of security tasks should be performed based on results of one or more previous security tasks of the plurality of security tasks.
6. The method of claim 4 , further comprising transferring results of one or more previous security tasks of the plurality of security tasks to a next security task of the plurality of security tasks.
7. The method of claim 1 , wherein the plurality of security tasks are performed in parallel.
8. The method of claim 1 , further comprising normalizing the results by the SIEM device.
9. The method of claim 1 , further comprising:
performing asset correlation to the results of the plurality of security tasks;
reporting the results of the plurality of security tasks when they are correlated to core network assets.
10. The method of claim 1 , further comprising reporting the results of the plurality of security tasks based on an alert policy.
11. The method of claim 1 , wherein the work flow template comprises a website automatic discovery work flow template and the plurality of security tasks comprise a service discovery, a test Hypertext Transfer Protocol (HTTP) service and a website scan.
12. The method of claim 1 , wherein the work flow template comprises a website scan work flow template and the plurality of security tasks comprise website scanning and web application firewall blocking.
13. The method of claim 1 , wherein the work flow template comprises a closed-loop security event processing work flow template and the plurality of security tasks comprise event collecting, leakage verification and emergency response processing.
14. The method of claim 13 , wherein the plurality of security tasks further comprise correlation analysis, risk warning and leakage repair.
15. A security information and event management (SIEM) system of a private network, the SIEM system comprising:
a non-transitory storage device having embodied therein one or more routines; and
one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
starting a work flow instance by
deriving said work flow instance from a work flow template, including translating information contained within the work flow template, defining a plurality of security tasks at an abstract level, into commands and parameters (i) for accomplishing the plurality of security tasks by a plurality of security devices from at least two different manufacturers and (ii) that are specific to the plurality of security devices, wherein the plurality of security devices are associated with the private network and managed by the SIEM system, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks; and
scheduling the plurality of security devices to perform the plurality of security tasks defined in the work flow template by sending the commands and parameters to the plurality of security devices through a device adapter layer implemented by the SIEM system; and
collecting, by the STEM system, results of the plurality of security tasks after they are performed by the plurality of security devices.
16. The STEM system of claim 15 , wherein the work flow template comprises a website automatic discovery work flow template and the plurality of security tasks comprise a service discovery, a test Hypertext Transfer Protocol (HTTP) service and a website scan.
17. The STEM system of claim 15 , wherein the work flow template comprises a website scan work flow template and the plurality of security tasks comprise website scanning and web application firewall blocking.
18. The STEM system of claim 15 , wherein the work flow template comprises a closed-loop security event processing work flow template and the plurality of security tasks comprise event collecting, leakage verification and emergency response processing.
19. The SIEM system of claim 15 , wherein the plurality of security tasks are performed serially by the plurality of security devices.
20. The STEM system of claim 15 , wherein the plurality of security tasks are performed in parallel by the plurality of security devices.