L3-Base - Threat and Impact Analysis

181214

Micro Focus Micro Focus Community

Micro Focus | Micro Focus Community

This package contains the supporting resources (active lists and rules) for tracking the activity of systems, user accounts, service accounts, system accounts, etc., across the ArcSight Attack Life Cycle phases for this method.

0 reviews

390 downloads

See previous releases

Product compatibility

ESM

CATEGORY

ArcSight | Activate L3

Screenshots
Description
Requirements
Suggested apps
Releases
Resources
Reviews

Have questions about this item?

Contact us
Subscribe to receive update notifications for this item
Subscribe

Description

The Threat and Impact Analysis package supports Level 3 - Threat Refinement (in Activate terms, Level 3 - Impact and Threat Analysis). Here we track the events for attacker and targets, systems and entities, across the ArcSight Attack Life Cycle. We also track the states of systems and entities of interest. Finally, we track the activity of systems based on activity seen by or affecting them across the attack life cycle or based on their state. In some cases, as with the use cases provided by this base package, the use cases and user stories are based on correlation events across multiple Defense Monitoring in Depth layers. Other L3 use cases are specific to a DMiD layer.

Minimum Requirements

Activate Base - Version 2.5.3.0 and later.

Suggested apps

Micro Focus COMMUNITY

Firewall Monitoring

Micro Focus

The Firewall Monitoring use case has been updated. Firewall Monitoring 1.2 provides improved content and performance, as well as additional resources

Micro Focus COMMUNITY

Anomalous Traffic Detection

Micro Focus

The Anomalous Traffic Detection use case helps you identify sudden spikes in network traffic so that you can detect potential malicious activity. Sudden spikes in traffic can be caused by scheduled backups or virus scanner updates inside your LAN.

Micro Focus COMMUNITY

Activate P-Blue Coat Proxy

Micro Focus

Product package covering proxy traffic events from Blue Coat.

Micro Focus COMMUNITY

Activate P-Snort

Micro Focus

This product-specific package includes the resources that support the Perimeter and Network Monitoring use case categories. Install this package if you collect Snort or Sourcefire logs for your ESM.

SolarWinds SUNBURST Detection

Yun Peng

This package detects SolarWinds SUNBURST attacks.

Microsoft Sysmon FlexConnector

Kevin Q

FlexConnector for the extraction and categorization of the “Microsoft-Windows-Sysmon/Operational” Windows Event Log using Microfocus ArcSight Windows Native SmartConnector Updated for Sysmon V 10.x

Micro Focus COMMUNITY

Brute Force Attack Package for Logger

Micro Focus

The Brute Force Attack use case uncovers and tracks, attempts and confirmed attacks using a brute force technique on network assets and applications

Micro Focus COMMUNITY

ESM Default Content

Micro Focus

ESM Default Content includes Security Threat Monitoring package and Threat Intelligence Platform package, It also includes resources for tracking Techniques from the MITRE ATT& CK framework.

Micro Focus COMMUNITY

RSA ACE SNMP Trap Parser Override

Micro Focus

Puts the Sending Agent into the Device Address field.

Releases

Release

Size

Date

L3-Base - Threat and Impact Analysis 0.1.0.1

155.3 KB

|

Aug 15, 2018

More info Less info

Product compatibility

ESM

Version 7.4 · 7.3 · 7.2 · 7.1 · 7.0

Version 6.8 · 6.9.1 · 6.11.0

Release notes

Micro Focus rebranding changes.

Languages

English

Files

(155.3 KB)

L3-Base-Threat and Impact Analysis 0.1.0.0

149.7 KB

|

Jul 6, 2018

More info Less info

Product compatibility

ESM

Version 7.4 · 7.3 · 7.2 · 7.1 · 7.0

Version 6.8 · 6.9.1 · 6.11.0

Release notes

First release of L3 Base Threat and Impact Analysis.

Languages

English

Files

(149.7 KB)

Resources

Documentation

Activate License

Activate Framework

Video

Your browser is not supported!

Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox

release-rel-2021-2-3-3805 | Wed Feb 24 23:06:24 PST 2021