Security Analytics 8.1.x Reference Guide
Updated: Friday, November 15, 2019
- Security Analytics Reference Guide
- Security Analytics 8.1
Copyrights, Trademarks, and Intellectual Property
Copyright © 2019 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU.
3
- Security Analytics Reference Guide
- Security Analytics 8.1
Table of Contents
12 12 12 13
Specify the Storage Location Manual Backup Encrypted Backup Scheduled Backup
GRE Encapsulation and BPF Filters
Standard Syslog Facilities Standard Syslog Levels and Priorities
CLI Commands Supported Linux Commands csr.sh
26 27 27 27 27 28 28 28 29 29 29 dscapture clearpersist dscapture cleartime dscapture init dscapture map dscapture mapshow dscapture settime dscapture shutdown dscapture start dscapture status dscapture stop dscapture unmap
dsfilter dsfirewall, dsfirewall6
29 30
4
- Security Analytics Reference Guide
- Security Analytics 8.1
dslc add dslc del dslc disable dslc enable dslc export dslc factory dslc import dslc set
32 34 34 35 36 37 37 37 39 39 dslc show dslogdump
Data-Migration Procedure Operation of dsmigratedata
45 47
Restarting dsmigratedata
dspcapimport dsportmapping dsregen
48 49 50
55 55 55 56 56 56 57 dump_slot_header slot_<number> dump_slot_elements <filename> dump_slot_pcap <packet_number> dump_slot_trail dump_space_table_entry <slot_id> walk_space_table_journal
5
- Security Analytics Reference Guide
- Security Analytics 8.1
lsi-rate-tool lsi-show MegaCli | megacli scm pivot_only_provider
58 60 61 62
Delete a Pivot-Only Provider Sample Pivot-Only Providers
66 66
Install and Test the SoleraConnector Class Session-Based APIs Pivot to Summary Page Single Time-Value Configuration
Authentication APIs BPF Filters APIs Capture APIs
100 111 116 137 158 178
Central Manager APIs Data Enrichment APIs Date/Time APIs
6
- Security Analytics Reference Guide
- Security Analytics 8.1
Drive-Space Management APIs Extractor APIs
182 186 219 226 236 240 265 268 274 277 300 302 338 347 367 369 378 380 386 405 414
Geolocation APIs Indicators APIs License APIs Logging and Communication APIs Metadata APIs Network APIs Packet Analyzer APIs PCAP APIs Playback APIs Report and Report Status APIs Rules APIs Security APIs Statistics APIs Summary Page APIs System APIs Upgrades APIs User Account APIs Web Interface Settings APIs API Appendix
7
- Security Analytics Reference Guide
- Security Analytics 8.1
416 418 419 419 419 419 420 422 422 422
Syntax: Advanced-Filter Array Syntax: Primary Filter Array Syntax: Timespan Array Syntax: Timespan Date Array Syntax: Geolocation Internal Labels Syntax: Scheduled Events LDAP Schema Values Menu > Analyze > Alerts > Summary Menu > Analyze > Anomalies > Summary Capture Summaries Inputs
Best Practices Downloading Extracted Artifacts Downloading PCAPs
8
- Security Analytics Reference Guide
- Security Analytics 8.1
Recognized Applications
59 New Recognized Applications in Security Analytics 8.1.1. Total: ~2900 To obtain an XLSX or CSV list of recognized applications, select Reference > Recognized Applications in the Help Files, which are located:
n
In the web interface under About
> Help > [language].
n
On https://support.symantec.com/content/unifiedweb/en_US/Documentation.1145515.html.
Select the appropriate version, and then under Administration Guide open the Security Analytics 8.1.1
WebGuide.
The applications in the files can be identified by Security Analytics. The values in these tables appear in the
Application, Application Group and Application Group over Time reports and report widgets and are valid for
application_group=<application_group> and application_id=<application_id> in the primary filter bar, for
example, application_group="Network Service" or application_id=twitter
Application Groups
Following are sample applications that are included in each application group. Where the last item is preceded by the word "and," all applications for that group are listed:
nnn
Antivirus — zonealarm, zonealarm_update, sophos_update, and lookout_ms Application Service — citrix_pvs, ldap, syslog, perforce, windows_marketplace, xfs Audio/Video — apple_music, baidu_player, google_play_music, gotomeeting, h245, hulu, iheartradio, itunes, netflix, pplive, qqlive, rtsp, spotify
nnnnnnnn
Authentication — chap, diameter, krb5, pap, radius, tacacs_plus
Behavioral — high_entropy and spid Compression — ccp and comp
Database — db2, drda, mysql, postgres, sybase, tds, tns Encrypted — i2p, ipsec, isakmp, ocsp, ssh, ssl, tor, and tor2web
ERP — sap
File Server — afp, ftp, gmail_drive, netbios, nfs, smb, tftp File Transfer — aim_transfer, bits, filesharepro, imessage_file_download, irc_transfer, irods, jabber_ transfer, mypocket, paltalk_transfer, and ymsg_transfer
n
Forum — google_groups, ircs, kaskus, linkedin, live_groups, mibbet, nntp, nntps, odnoklassniki, r10, tapatalk, vkontakte, and yahoo_groups
9
- Security Analytics Reference Guide
- Security Analytics 8.1
nn
Game — all_slots_casino, angry_birds, candy_crush_saga, cstrike, eve_online, poker_stars, qq_r2, quake, runescape, wow
Instant Messaging — aim, badoo, facebook_messenger, gmail_chat, gtalk, irc, jabber, qq, whatsapp, ymsg
nnnnn
Mail — imap, imaps, lotusnotes, mapi, pop3, pop3s, smtp, and smtps
Microsoft Office — groove
Middleware — amqp, dcerpc, diop, giop, iiop, java_rmi, rpc, soap, thrift Network Management — cdp, cip, enip, lcp, modbus, netflow, rsvp, sccm, snmp, wccp Network Service — 8021q, arp, crudp, dccp, dhcp, dnp3, dns, eth, fibre_channel, hopopt, icmp, ip, ip6, isis, mux, nbns, ntp, sctp, svn, udp, whois
nnnnnnnnnnn
Peer to Peer — bitcoin, bittorrent, directconnect, edonkey, filetopia, gnutella, kazaa, qqmusic, thunder Printer — apple_airprint, bjnp, cups, ipp, jetdirect, and lpr Routing — bgp, eigrp, mpls, ospf, rip1, rip2, stp Security Service — fsecure, ghostsurf, mcafee, and peerguardian Standard — established, incomplete, malformed, and unknown
Telephony — bssap and isup
Terminal — rlogin, rsh, telnet, telnets, and tnvip Thin Client — anydesk, gotomypc, ica, jedi, pcanywhere, radmin, rdp, vmware, x11 Tunneling — etherip, gre, http_tunnel, l2tp, ppp, pppoe, socks5, teredo WAP — bxml, mmse, smpp, ucp, wsp, wtls, and wtp Web — 4chan, abcnews, alibaba, amazon_aws, baidu, bbc, disney_channel, ebay, elpais, facebook, flickr, google, http, https, kaspersky, nytimes, outlook, pandora, reddit, sharepoint, travelocity, tumblr, twitter, wikipedia, windows_update, yahoo, youtube
n
Webmail — gmail, live_hotmail, mailru, orangemail, owa, yandex_webmail, ymail2, zimbra
10
- Security Analytics Reference Guide
- Security Analytics 8.1
