Correlation Tab; Understanding Correlation - Novell SENTINEL 6.1 SP2 - 02-2010 User Manual

Correlation Tab

3
Section 3.1, "Understanding Correlation," on page 65

Section 3.2, "Introduction to the User Interface," on page 67

Section 3.3, "Correlation Rules," on page 67

Section 3.4, "Dynamic Lists," on page 82

Section 3.5, "Correlation Engine," on page 85

Section 3.6, "Correlation Actions," on page 86


3.1 Understanding Correlation

Sometimes, an event viewed in the system might not necessarily draw your attention. But, when you
correlate a set of similar or comparable events in a given period, it might lead you to an alarming
event. Sentinel helps you correlate such events with the rules you create and deploy in the
Correlation engine and take appropriate action to mitigate any alarming situation.
Correlation adds intelligence to security event management by automating analysis of the incoming
event stream to find patterns of interest. Correlation allows you to define rules that identify critical
threats and complex attack patterns so that you can prioritize events and initiate effective incident
management and response. Starting with Sentinel 6.0, the correlation engine is built with a
pluggable framework, which allows the addition of new correlation engines in the future.
Correlation rules define a pattern of events that should trigger, or fire, a rule. Using either the
correlation rule wizard or the simple RuleLG language, you can create rules that range from simple
to extremely complex, for example:
High severity event from a finance server

High severity event from any server brought online in the past 10 days

Five failed logins in 2 minutes

Five failed logins in 2 minutes to the same server from the same username

Intrusion detection event targeting a server, followed by an attempted login to root originating

from that same server within 60 seconds
Two or more of these rules can be combined into one composite rule. The rule definition determines
the conditions under which the composite rule fires:
All subrules must fire

A specified number of subrules must fire

The subrules must fire in a particular sequence

After the rule is defined, it should be deployed to an active Correlation Engine, and one or more
actions can be associated with it. After the rule is deployed, the Correlation Engine processes events
from the real-time event stream to determine whether they should trigger any of the active rules to
fire.
3
Correlation Tab 65