Forcepoint 整合

您可以將 Forcepoint NGFW 與 Sophos Central 整合，以便將警示傳送到 Sophos。

此頁面提供集成的概述。

Forcepoint產品概述

Forcepoint Next-Generation Firewall (NGFW) 透過採用複雜的機制來發揮作用，這種機制提供網路流量的可見性、控制和背景分析，從而實現安全原則和防禦的動態調整。透過利用先進技術和以使用者為中心的方法，防火牆可以促進強大的威脅預防和偵測，保護組織的資產、資料和網路基礎架構。

Sophos 技術文檔

我們攝取的東西

我們看到的示例警報：

China.Chopper.Web.Shell.Client.Connection
Easy.Hosting.Control.Panel.FTP.Account.Security.Bypass
HTTP.URI.SQL.Injection
Malicious.HTTP.URI.Requests
Joomla!.com_fields.SQL.Injection

已擷取完整警示

建議您配置Forcepoint的標準syslog輸出，其中包括以下主題：

BSD系統的時鐘守護程序
System V系統的時鐘守護程序
文件傳輸協議
內核消息
行式列印機子系統
郵件系統
syslogd內部生成的消息
網路新聞子系統
網路時間協議
隨機用戶級消息
安全/授權消息
安全/授權消息(私人)
系統守護程序
uucp子系統

有關標準syslog輸出，請參見 Syslog Entries。

篩選

我們按以下方式篩選警報。

允許

有效 CEF

丟棄

說明

根據我們的MDR分析小組的反饋，這些條目被歸類為與安全無關的事件。它們主要包括例行VPN活動，標準網路操作和自動系統消息，這些消息重複且通常不重要，因此無需記錄。

正則表達式模式

msg=Connection dropped
msg=Delete notification received for .* SPI
\\|File-Filtering-Policy_Buffering-Limit-Exceeded\\|
\\|FW_New-SSL-VPN-Connection\\|
msg=IPsec SA Import succeeded

範例

msg=IPsec SA initiator done. Rekeyed SPI: .* Encryption:.*, mac:.*
msg=IPsec SA responder done
msg=IKE SA deleted
msg=IKEv2 SA error: Timed out
msg=IKEv2 SA initiator failed, Local auth method: Reserved, Remote auth method: Reserved
msg=IPsec SA initiator error: Timed out
msg=Message type ack. XID: .* Relay ip .* Server ID: .* DNS: .* DNS: .* Domain: .*
msg=Message type offer. XID: .* Relay ip .* Server ID: .* DNS: .* DNS: .* Domain: .*
msg=Sending Dead Peer Detection notify \\(.*\\)
msg=Starting IKEv2 initiator negotiation
\\|TCP_Option-Unknown\\|
\\|URL_Category-Accounting\\|
msg=New engine upgrades available on Forcepoint web site: Engine upgrades NGFW upgrade .* build \\d+ for .*
\\|TCP_Segment-SYN-No-Options\\|
msg=Connection was reset by client
\\|FW_New-Route-Based-VPN-Connection\\|0\\|.* act=Discard
\\|TCP_Checksum-Mismatch\\|
msg=Notifications: N\\(HTTP_CERT_LOOKUP_SUPPORTED\\), N\\(MESSAGE_ID_SYNC_SUPPORTED\\), N\\(ESP_TFC_PADDING_NOT_SUPPORTED\\), N\\(NON_FIRST_FRAGMENTS_ALSO\\)
\\|FW_New-IPsec-VPN-Connection\\|
\\|FW_Related-Connection\\|
\\|Connection_Progress\\|
msg=Connection was reset by server
msg=Connection timeout in state TCP_SYN_SEEN
\\|Connection_Rematched\\|
\\|Connection_Allowed\\|
\\|Connection_Discarded\\|
\\|Connection_Closed\\|
\\|Log_Compress-SIDs\\|
act=Allow msg=Referred connection
\\|FW_New-Route-Based-VPN-Connection\\|0\\|.* act=Allow
\\|HTTP_URL-Logged\\|1\\|.* act=Permit
msg=Message type \\w+. XID: .*. Relay ip .*. Relayed to .*
\\|Generic\\|0\\|.*msg=Rekeyed IPsec SA installed. Inbound
msg=HISTORY: PID\\W+\\d+ UID\\W+\\d+ USER\\W+\\w+
msg=\\[I\\]\\[.*\\] Gid map: inside_gid:\\d+ outside_gid:\\d+ count:\\d+
msg=\\[I\\]\\[.*\\] Jail parameters
msg=\\[I\\]\\[.*\\] Uid map: inside_uid:\\d+ outside_uid:\\d+ count:\\d+
msg=\\[I\\]\\[.*\\] pid\\W+\\d+ \\(\\[STANDALONE MODE\\]\\) exited with status: \\d+, \\(PIDs left: \\d+\\)
msg=\\[I\\]\\[.*\\] Mount: .* flags:.* type:.* options:.* dir:.*
\\|DNS_Client-Type-Unknown\\|2\\|.* act=Permit
\\|File_Allowed\\|1\\|.* act=Permit
\\|HTTP_Request-with-redirect-capability\\|1\\|
\\|FW_Info-Request\\|0\\|
\\|Generic\\|0\\|.*msg=\\[\\d+\\.\\d+\\].*

威脅映射示例

"alertType": "Mirai.Botnet", "threatId": "T1498", "threatName": "Network Denial of Service",
"alertType": "WIFICAM.P2P.GoAhead.Multiple.Remote.Code.Execution", "threatId": "T1203", "threatName": "Exploitation for Client Execution",
"alertType": "TCP.Split.Handshake", "threatId": "T1082", "threatName": "System Information Discovery",
"alertType": "WePresent.WiPG1000.Command.Injection", "threatId": "T1203", "threatName": "Exploitation for Client Execution",
"alertType": "Open.Flash.Chart.PHP.File.Upload", "threatId": "T1105", "threatName": "Ingress Tool Transfer",