In this lecture I will give a brief introduction about Elsa.
So what is Elsa.
Elsa or enterprise.
Look search and archive easy centralize this lock framework that is based on CIS look e.g. my squirrel
and two things full text search that provides you fully synchronous with paste query interface that
normalizes logs and makes searching billions of them for our particularly strings as easy as searching
that way.
It includes tools to assign permissions for viewing the logs and email based alerts spiritual queries
and graphing
Elsa is an IBM product and is IBM or Security Information and Event Management is the glue for various
security tools it can provide information in both real time alerts and historical reports that summarize
the security status of our time.
Typically on the order of months rather than days the main is IBM.
Functions include log collection of event records from sources throughout the organization.
Look for normalization to map log messages from different systems to incoming data model logs correlation
to speed the detection of and reaction to security threats log aggregation to reduce the volume of event
data to be analyzed and finally reporting tools to address regulation compliance reporting requirements
so Elsa is an open source centralized sis LOC compiler and search query too.
It provides many of the functions that are typically found within most of the commercially available
as IBM products.
Examples of those products are Splunk Enterprise Security IBM security curator Luke raison and sonar
wine slog and Event Manager when walking with Elsa.
You can accomplish the same task using multiple ways which I will explain how to do.
In the following pictures
Elsa as an as I am provides look normalization which is the process of manipulating security in data
and tweeting into a common schema Elsa has bar source that work with each of the data sources.
Examples of those data sources are broad which is an intrusion detection system program that is different
from the typical ideas snort which is the most widely deployed intrusion detection and prevention system
technology worldwide.
Sorry Carter.
Which is an open source next generation intrusion detection and prevention engine and SEC which is host
based intrusion detection system in the first part of how to work with Elsa.
We will see how to get logs from all about network connections
look summarization easy data mining technique in which compact descriptions of key data set qualities
are produced summarized data is often displayed in the graphical format or in tabular format summarization
is implemented with Elsa queries by using the group by directive or close which can be based on source
or destination IP addresses or boards for example.
Look summarization allows us to find the most interesting or suspicious traffic.
For example the traffic from the most active host in the second part of how to work with Elsa we will
see how to get summary report based on the source IP address.
These can be done in the query field by clicking on certain links or by using certain dropdown menus.
Local delegation easy data mining technique where data is gathered to get more information about particular
variables aggregation can be better performed by bullying or records that share a single common variable.
For example also it may be equated with simply an IP address
log aggregation allows us to focus our analysis on the records of the most interesting or suspicious
traffic found using log summarization in the first part of how to work with Elsa.
We will see how to get the records of each CBC fix source IP address.
Again this can be done in the query field by clicking on certain links or by using certain dropdown
menus saw in the in this picture.
I have given you a brief introduction about Asia and in the next lecture I will start explaining how
to work with Asia.
In practice.