Security Analytics 8.1.X Reference Guide

Security Analytics 8.1.x Reference Guide Updated: Friday, November 15, 2019 <ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul>Copyrights, Trademarks, and Intellectual Property Copyright © 2019 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU. 3<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul>Table of Contents <a href="#9_0">Recognized Applications </a><a href="#9_1">Application Groups </a><a href="#9_0">9</a><a href="#9_1">9</a><ul style="display: flex;"><li style="flex:1"><a href="#11_0">Backup and Restore </a></li><li style="flex:1"><a href="#11_0">11 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#11_1">Backup </a></li><li style="flex:1"><a href="#11_1">11 </a></li></ul><a href="#12_0">12 </a><a href="#12_1">12 </a><a href="#12_2">12 </a><a href="#13_0">13 </a> <a href="#12_0">Specify the Storage Location </a><a href="#12_1">Manual Backup </a><a href="#12_2">Encrypted Backup </a><a href="#13_0">Scheduled Backup </a><ul style="display: flex;"><li style="flex:1"><a href="#13_1">Restore </a></li><li style="flex:1"><a href="#13_1">13 </a></li></ul><a href="#15_0">BPF Syntax </a><a href="#15_1">GRE Encapsulation and BPF Filters </a><a href="#15_0">15 </a><a href="#15_1">15 </a><a href="#17_0">Syslog Facilities </a><a href="#17_1">Standard Syslog Facilities </a><a href="#18_0">Standard Syslog Levels and Priorities </a><a href="#17_0">17 </a><a href="#17_1">17 </a><a href="#18_0">18 </a><ul style="display: flex;"><li style="flex:1"><a href="#19_0">Disable SSH Root Logins </a></li><li style="flex:1"><a href="#19_0">19 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#20_0">20 </a></li><li style="flex:1"><a href="#20_0">MD5-Encrypted Password for Bootloader </a></li></ul><a href="#0_0">Command-Line Interface </a><a href="#0_1">CLI Commands </a><a href="#0_2">Supported Linux Commands </a><a href="#0_3">csr.sh </a><a href="#0_0">21 </a><a href="#0_1">21 </a><a href="#0_2">24 </a><a href="#0_3">26 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_4">dscapture </a></li><li style="flex:1"><a href="#0_4">26 </a></li></ul><a href="#0_5">26 </a><a href="#0_6">27 </a><a href="#0_7">27 </a><a href="#0_8">27 </a><a href="#0_9">27 </a><a href="#0_6">28 </a><a href="#0_10">28 </a><a href="#0_11">28 </a><a href="#0_6">29 </a><a href="#0_12">29 </a><a href="#0_13">29 </a><a href="#0_5">dscapture clearpersist </a><a href="#0_6">dscapture cleartime </a><a href="#0_7">dscapture init </a><a href="#0_8">dscapture map </a><a href="#0_9">dscapture mapshow </a><a href="#0_6">dscapture settime </a><a href="#0_10">dscapture shutdown </a><a href="#0_11">dscapture start </a><a href="#0_6">dscapture status </a><a href="#0_12">dscapture stop </a><a href="#0_13">dscapture unmap </a><a href="#0_14">dsfilter </a><a href="#0_15">dsfirewall, dsfirewall6 </a> <a href="#0_14">29 </a><a href="#0_15">30 </a>4<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul><a href="#0_0">dslc </a><a href="#0_16">dslc add </a><a href="#0_17">dslc del </a><a href="#0_18">dslc disable </a><a href="#0_19">dslc enable </a><a href="#0_20">dslc export </a><a href="#0_21">dslc factory </a><a href="#0_22">dslc import </a><a href="#0_23">dslc set </a><a href="#0_0">32 </a><a href="#0_16">32 </a><a href="#0_17">34 </a><a href="#0_18">34 </a><a href="#0_19">35 </a><a href="#0_20">36 </a><a href="#0_21">37 </a><a href="#0_22">37 </a><a href="#0_23">37 </a><a href="#0_24">39 </a><a href="#0_25">39 </a><a href="#0_24">dslc show </a><a href="#0_25">dslogdump </a><a href="#0_0">dsmigrate.sh </a><a href="#0_26">Setup </a><a href="#0_21">Migrate the Data </a><a href="#0_0">40 </a><a href="#0_26">41 </a><a href="#0_21">42 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_0">dsmigratedata </a></li><li style="flex:1"><a href="#0_0">44 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_27">Setup </a></li><li style="flex:1"><a href="#0_27">44 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_28">45 </a></li><li style="flex:1"><a href="#0_28">Interface Configuration </a></li></ul><a href="#0_29">Data-Migration Procedure </a><a href="#0_30">Operation of dsmigratedata </a> <a href="#0_29">45 </a><a href="#0_30">47 </a> <a href="#0_21">Restarting dsmigratedata </a><a href="#0_31">Stateful Restart </a><a href="#0_21">48 </a><a href="#0_31">48 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_32">48 </a></li><li style="flex:1"><a href="#0_32">Stateless Restart </a></li></ul><a href="#0_33">dspcapimport </a><a href="#0_24">dsportmapping </a><a href="#0_21">dsregen </a> <a href="#0_33">48 </a><a href="#0_24">49 </a><a href="#0_21">50 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_34">dszap </a></li><li style="flex:1"><a href="#0_34">51 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_6">53 </a></li><li style="flex:1"><a href="#0_6">Actions Performed </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_35">Running dszap </a></li><li style="flex:1"><a href="#0_35">53 </a></li></ul><a href="#0_0">dump_slot </a><a href="#0_36">dump_slot_chain </a><a href="#0_0">55 </a><a href="#0_36">55 </a><a href="#0_37">55 </a><a href="#0_38">55 </a><a href="#0_39">56 </a><a href="#0_40">56 </a><a href="#0_41">56 </a><a href="#0_21">57 </a><a href="#0_37">dump_slot_header slot_<number> </a><a href="#0_38">dump_slot_elements <filename> </a><a href="#0_39">dump_slot_pcap <packet_number> </a><a href="#0_40">dump_slot_trail </a><a href="#0_41">dump_space_table_entry <slot_id> </a><a href="#0_21">walk_space_table_journal </a>5<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_42">dynfilter </a></li><li style="flex:1"><a href="#0_42">57 </a></li></ul><a href="#0_43">lsi-rate-tool </a><a href="#0_44">lsi-show </a><a href="#0_45">MegaCli | megacli </a><a href="#0_21">scm pivot_only_provider </a> <a href="#0_43">58 </a><a href="#0_44">60 </a><a href="#0_45">61 </a><a href="#0_21">62 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_46">Add a Pivot-Only Provider </a></li><li style="flex:1"><a href="#0_46">62 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_47">63 </a></li><li style="flex:1"><a href="#0_47">Pivot-Only Provider Demonstration </a></li></ul><a href="#0_48">Delete a Pivot-Only Provider </a><a href="#0_49">Sample Pivot-Only Providers </a> <a href="#0_48">66 </a><a href="#0_49">66 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_50">scm sessions </a></li><li style="flex:1"><a href="#0_50">68 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_51">69 </a></li><li style="flex:1"><a href="#0_51">scm solera_acl elevate </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_52">scm tally </a></li><li style="flex:1"><a href="#0_52">69 </a></li></ul><a href="#0_0">Web Services APIs </a><a href="#0_53">Install and Test the SoleraConnector Class </a><a href="#0_54">Session-Based APIs </a><a href="#0_55">Pivot to Summary Page </a><a href="#0_21">Single Time-Value Configuration </a><a href="#0_0">71 </a><a href="#0_53">71 </a><a href="#0_54">73 </a><a href="#0_55">73 </a><a href="#0_21">74 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_0">API Changes in Security Analytics 8.1.x </a></li><li style="flex:1"><a href="#0_0">75 </a></li></ul><a href="#0_56">75 </a><a href="#0_57">75 </a> <a href="#0_56">New APIs </a><a href="#0_57">Modified APIs </a><a href="#0_0">Advanced API Queries </a><a href="#0_58">Example Queries </a><a href="#0_0">77 </a><a href="#0_58">77 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_59">77 </a></li><li style="flex:1"><a href="#0_59">Combining Different Namespaces </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_0">Alerts APIs </a></li><li style="flex:1"><a href="#0_0">79 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_0">91 </a></li><li style="flex:1"><a href="#0_0">Anomalies APIs </a></li></ul><a href="#0_0">Authentication APIs </a><a href="#0_0">BPF Filters APIs </a><a href="#0_0">Capture APIs </a> <a href="#0_0">100 </a><a href="#0_0">111 </a><a href="#0_0">116 </a><a href="#0_0">137 </a><a href="#0_0">158 </a><a href="#0_0">178 </a> <a href="#0_0">Central Manager APIs </a><a href="#0_0">Data Enrichment APIs </a><a href="#0_0">Date/Time APIs </a>6<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul><a href="#0_0">Drive-Space Management APIs </a><a href="#0_0">Extractor APIs </a> <a href="#0_0">182 </a><a href="#0_0">186 </a><a href="#0_0">219 </a><a href="#0_0">226 </a><a href="#0_0">236 </a><a href="#0_0">240 </a><a href="#0_60">265 </a><a href="#0_0">268 </a><a href="#0_0">274 </a><a href="#0_0">277 </a><a href="#0_0">300 </a><a href="#0_0">302 </a><a href="#0_0">338 </a><a href="#0_0">347 </a><a href="#0_0">367 </a><a href="#0_0">369 </a><a href="#0_0">378 </a><a href="#0_0">380 </a><a href="#0_0">386 </a><a href="#0_0">405 </a><a href="#0_0">414 </a> <a href="#0_0">Geolocation APIs </a><a href="#0_0">Indicators APIs </a><a href="#0_0">License APIs </a><a href="#0_0">Logging and Communication APIs </a><a href="#0_60">Metadata APIs </a><a href="#0_0">Network APIs </a><a href="#0_0">Packet Analyzer APIs </a><a href="#0_0">PCAP APIs </a><a href="#0_0">Playback APIs </a><a href="#0_0">Report and Report Status APIs </a><a href="#0_0">Rules APIs </a><a href="#0_0">Security APIs </a><a href="#0_0">Statistics APIs </a><a href="#0_0">Summary Page APIs </a><a href="#0_0">System APIs </a><a href="#0_0">Upgrades APIs </a><a href="#0_0">User Account APIs </a><a href="#0_0">Web Interface Settings APIs </a><a href="#0_0">API Appendix </a><ul style="display: flex;"><li style="flex:1"><a href="#0_0">Using Polling with the APIs </a></li><li style="flex:1"><a href="#0_0">415 </a></li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_61">415 </a></li><li style="flex:1"><a href="#0_61">Syntax: Identity Path </a></li></ul>7<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul><ul style="display: flex;"><li style="flex:1"><a href="#0_62">Syntax: Enhanced Primary Filter Array </a></li><li style="flex:1"><a href="#0_62">415 </a></li></ul><a href="#0_63">416 </a><a href="#0_10">418 </a><a href="#0_6">419 </a><a href="#0_30">419 </a><a href="#0_64">419 </a><a href="#0_65">419 </a><a href="#0_66">420 </a><a href="#0_67">422 </a><a href="#0_68">422 </a><a href="#0_69">422 </a> <a href="#0_63">Syntax: Advanced-Filter Array </a><a href="#0_10">Syntax: Primary Filter Array </a><a href="#0_6">Syntax: Timespan Array </a><a href="#0_30">Syntax: Timespan Date Array </a><a href="#0_64">Syntax: Geolocation Internal Labels </a><a href="#0_65">Syntax: Scheduled Events </a><a href="#0_66">LDAP Schema Values </a><a href="#0_67">Menu > Analyze > Alerts > Summary </a><a href="#0_68">Menu > Analyze > Anomalies > Summary </a><a href="#0_69">Capture Summaries Inputs </a><a href="#0_0">Using the APIs </a><a href="#0_70">Best Practices </a><a href="#0_14">Downloading Extracted Artifacts </a><a href="#0_71">Downloading PCAPs </a><a href="#0_0">424 </a><a href="#0_70">424 </a><a href="#0_14">424 </a><a href="#0_71">428 </a><ul style="display: flex;"><li style="flex:1"><a href="#0_0">Resources </a></li><li style="flex:1"><a href="#0_0">432 </a></li></ul>8<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul>Recognized Applications 59 New Recognized Applications in Security Analytics 8.1.1. Total: ~2900 To obtain an XLSX or CSV list of recognized applications, select Reference > Recognized Applications in the Help Files, which are located: nIn the web interface under About > Help > [language]. nOn <a href="/goto?url=https://support.symantec.com/content/unifiedweb/en_US/Documentation.1145515.html" target="_blank">https://support.symantec.com/content/unifiedweb/en_US/Documentation.1145515.html</a>. Select the appropriate version, and then under Administration Guide open the Security Analytics 8.1.1 WebGuide. The applications in the files can be identified by Security Analytics. The values in these tables appear in the Application, Application Group and Application Group over Time reports and report widgets and are valid for application_group=<application_group> and application_id=<application_id> in the <a href="filters.htm#Primary_Filters" target="_blank">primary filter bar</a>, for example, application_group="Network Service" or application_id=twitter Application Groups Following are sample applications that are included in each application group. Where the last item is preceded by the word "and," all applications for that group are listed: nnnAntivirus — zonealarm, zonealarm_update, sophos_update, and lookout_ms Application Service — citrix_pvs, ldap, syslog, perforce, windows_marketplace, xfs Audio/Video — apple_music, baidu_player, google_play_music, gotomeeting, h245, hulu, iheartradio, itunes, netflix, pplive, qqlive, rtsp, spotify nnnnnnnnAuthentication — chap, diameter, krb5, pap, radius, tacacs_plus Behavioral — high_entropy and spid Compression — ccp and comp Database — db2, drda, mysql, postgres, sybase, tds, tns Encrypted — i2p, ipsec, isakmp, ocsp, ssh, ssl, tor, and tor2web ERP — sap File Server — afp, ftp, gmail_drive, netbios, nfs, smb, tftp File Transfer — aim_transfer, bits, filesharepro, imessage_file_download, irc_transfer, irods, jabber_ transfer, mypocket, paltalk_transfer, and ymsg_transfer nForum — google_groups, ircs, kaskus, linkedin, live_groups, mibbet, nntp, nntps, odnoklassniki, r10, tapatalk, vkontakte, and yahoo_groups 9<ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul>nnGame — all_slots_casino, angry_birds, candy_crush_saga, cstrike, eve_online, poker_stars, qq_r2, quake, runescape, wow Instant Messaging — aim, badoo, facebook_messenger, gmail_chat, gtalk, irc, jabber, qq, whatsapp, ymsg nnnnnMail — imap, imaps, lotusnotes, mapi, pop3, pop3s, smtp, and smtps Microsoft Office — groove Middleware — amqp, dcerpc, diop, giop, iiop, java_rmi, rpc, soap, thrift Network Management — cdp, cip, enip, lcp, modbus, netflow, rsvp, sccm, snmp, wccp Network Service — 8021q, arp, crudp, dccp, dhcp, dnp3, dns, eth, fibre_channel, hopopt, icmp, ip, ip6, isis, mux, nbns, ntp, sctp, svn, udp, whois nnnnnnnnnnnPeer to Peer — bitcoin, bittorrent, directconnect, edonkey, filetopia, gnutella, kazaa, qqmusic, thunder Printer — apple_airprint, bjnp, cups, ipp, jetdirect, and lpr Routing — bgp, eigrp, mpls, ospf, rip1, rip2, stp Security Service — fsecure, ghostsurf, mcafee, and peerguardian Standard — established, incomplete, malformed, and unknown Telephony — bssap and isup Terminal — rlogin, rsh, telnet, telnets, and tnvip Thin Client — anydesk, gotomypc, ica, jedi, pcanywhere, radmin, rdp, vmware, x11 Tunneling — etherip, gre, http_tunnel, l2tp, ppp, pppoe, socks5, teredo WAP — bxml, mmse, smpp, ucp, wsp, wtls, and wtp Web — 4chan, abcnews, alibaba, amazon_aws, baidu, bbc, disney_channel, ebay, elpais, facebook, flickr, google, http, https, kaspersky, nytimes, outlook, pandora, reddit, sharepoint, travelocity, tumblr, twitter, wikipedia, windows_update, yahoo, youtube nWebmail — gmail, live_hotmail, mailru, orangemail, owa, yandex_webmail, ymail2, zimbra 10 <ul style="display: flex;"><li style="flex:1">Security Analytics Reference Guide </li><li style="flex:1">Security Analytics 8.1 </li></ul>

Security Analytics 8.1.X Reference Guide

Details

Download

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

Support