A SIEM’s power is in its correlation. LOGTITAN has advanced threat detection capabilities.

LOGTITAN combines alerts, advanced correlations, profiles, user behavior rules to detect threats.

 

27 LOGTITAN SIEM Use Cases Examples for Threat Detection

 

Below list is sample use cases from LOGTITAN correlation library:

 

  1. If a user is in the administrator group and trying to authenticate to a server within a very critical servers list and failed, then monitor the same user for successful authentication to the same critical server within the next thirty minutes. If there is no successful authentication, notify.
  2. Users and Allowed IPs are updating periodically according to Access Control Policies. And if a user is not coming from this user’s allowed IPs and successfully authenticated to a DB with PII data, then notify.
  3. A user logged via LAN and simultaneously connected to VPN from a different geolocation.
  4. Warn if 5 failed login attempts are tried with different usernames from the same IP to the same machine in 15 minutes and after that, if a successful login occurs from the same IP to any machine.
  5. Warn if a host scan is made by an IP and then if a successful connection is established by the same IP and then backward connection is established from connected IP to connecting IP.
  6. Warn if more than 100 connections are established from the different external IPs to the same destination IP in one minute.
  7. Warn if 100 connections are established from the same external IP through different ports to the same destination IP in one minute.
  8. Warn if the same user tries more than three failed login attempts to the same machine in an hour.
  9. Warn if a user can’t log into any server and caused failed authentication and in two hours if that user can’t log into the same server.
  10. Warn if more than 100 packets are blocked by UTM/FireWall from the same source IP and don’t warn within an hour. (Millions of packets are blocked in case of DDOS attack. If email is sent for each, you are exposed to DDOS attack.)
  11. Report the source IP which causes unusual UDP traffic.
  12. Warn if a traffic is occurred to a destination or from a source in IP-Reputation list.
  13. Warn if network traffic occurs from the source or to a source in malicious link list.
  14. If someone sets up DHCP server in your network or if a different gateway broadcasts, to find out this: Warn if a traffic occurs from inside to outside or from outside to inside whose protocol is UDP, destination port is 67, and destination IP is not in registered in IP list.
  15. Warn if an IP scan occurs.
  16. Warn if SQL attack occurs via web server.
  17. Warn if the servers are accessed out of hours.
  18. Warn if the same user tries more than three failed login attempts to different machines in a minute.
  19. Warn If an attack followed by account change
  20. Warn If scan followed by an attack
  21. Detects An unusual condition where a source has authentication failures at a host but that is not followed by a successful authentication at the same host within 2 hours
  22. Look for a new account being created followed by immediate authentication activity from that same account would detect the backdoor account creation followed by the account being used to telnet back into the system
  23. Monitor same source having excessive login failures at distinct hosts.
  24. Check whether the source of an attack was previously the destination of an attack (within 15 minutes)
  25. Check whether there are 5 events from host firewalls with severity 4 or greater in 10 minutes between the same source and destination IP
  26. Look for a new account being created, followed shortly by access/authentication failure activity from the same account
  27. Monitor system access outside of business hours