application – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu Next Generation SIEM & SOAR Tue, 05 Nov 2024 11:03:07 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.2 https://www.sgbox.eu/wp-content/uploads/2025/02/cropped-SGBox-symbol-png-32x32.webp application – SGBox Next Generation SIEM & SOAR https://www.sgbox.eu 32 32 Telegram App https://www.sgbox.eu/en/knowledge-base/telegram-app/ Tue, 18 Jun 2024 09:19:38 +0000 https://www.sgbox.eu/?post_type=epkb_post_type_1&p=25265

Configure SGBox to use Telgram API in LCE Module and send alert messages

This articles explain how to configure SGBox to interact with Telegram API in order to send alert messages when a specific event occur.

Requirements:

  • SGBox version 4.2.4 with the LM and LCE modules.
  • A Telegram BOT.

There are many tutorial about how to configure a Telegram BOT. We choose @BotFather for our example.
First you need to create your bot and obtain your TOKEN:

Telegram App

Telegram App

A token is something like: 1148120703:AbIUGpERusdQDEEag_EL1KDtynRB9sIhbj1.
You need also a the chat_id, so: start and say “Hello” to your bot, than retrieve the chat id:

Telegram App

From your browser go to:
https://api.telegram.org/bot1148120703:AbIUGpERusdQDEEag_EL1KDtynRB9sIhbj1/getupdates

Find the ID in the response:
Telegram App
id: 124229696

Telegram App Installation

Install Telegram application: SCM  > Applications

Telegram App

     > Packages 

Telegram App

find the “Telegram Alert”, in this case the package is already installed but the installation’s button is in the same place 

Telegram App

After the dowmload we verify in PB 

Telegram App

When PB is open search Tlegram alert in filter name 

Telegram App

When we find Telegram_Alert we need to modify with the button on the right side 

Telegram App

Telegram_Alert’s Playbook has this format

Telegram App

Afetr we need to create an Event/logs queries to connect with the Telegram_Alert’s Playbook, we have to go to LM  > Analysis >  Event/logs queries

Telegram App

Create new Queries with the blue button on the right 

Telegram App

in the select we put the parameters that we are interested in seeing in the future message that will arrive on our Telegram.

On this example we write:

 $HOST as Host, $EVENT as Action, $PARAM:[TargetUserName] as details, $TIMESTAMP as Timestamp
Telegram App

Now set your “FROM”  ( The class or classes ) 

Telegram App

Now i choose the event or events:

Telegram App

Important: we need to verify the proper functioning of our query, NB: before clicking the test button, chech the range time

Telegram App

Now press the button = ” Show Scheduling Options “

Telegram App

put the tick on the flag ” Run Playbook ” and choose our Telegram alert

Telegram App

back to the playbook section

Telegram App

we have to set our Telegram bot credential, to do it we can go on the second rectangle from the left and click on modify:

Telegram App

Name fileld: bot_id ( do not change ),  ( we can find in the first part of our guide the credentials that need to be entered  )

Value: 1148120703:AbIUGpERusdQDEEag_EL1KDtynRB9sIhbj1

Name fileld: chat_id ( do not change ),  ( we can find in the first part of our guide the credentials that need to be entered  )

Value: 124229696

Also when we finisched to insert our credential, we can test all and save, close the window

Telegram App

go to format message 

Telegram App

same passage as before click on the edit button, in the section text we write the telegrammessage that will come to us once we set :

Telegram Alert
Host: $1

Action: $2 

Details: $3

Timestamp: $4

the values refer to the query we made earlier, to add parameters in the text message click on plus or trash to delete 

Save all with the button on the right “save”

Telegram App

Back to Playbook section, search Telegram_Alert and check the status of the playbook on the right side, if it’s green playbook will alert you whenever the event we have indicated will happen

Telegram App

If it’s all correctly, after the login telegram alert me that someone has done a LogonOK

Telegram App
]]> User Behavior Analytics https://www.sgbox.eu/en/knowledge-base/user-behavior-analytics/ Wed, 28 Aug 2019 10:16:35 +0000 https://10.253.1.90/sgbox/EN/?post_type=epkb_post_type_1&p=2339 User Behavior Analytics (UBA)

The behavior analysis is an extension of the Risk Analysis and takes into consideration all the events related to the user and performs a series of evaluations to define whether the behavior of a certain user is considered “normal” or not.
Statistical algorithms analyze the historical data related to the user, the actions performed and the hosts on which these actions took place.

Requirements:

  • SGBox Version 4.2.1.
  • The User Behavior Analytics must be unlocked. Contact us for more information.

Examples of anomalies:

  • the user Mario always connects in VPN every morning at 9 AM. One day starts the VPN at 3AM.
  • the user Giovanni has never accessed to the core switch. One day he access.
  • the user Luigi has never seen before. One day he login to a Windows system.

Evaluations performed:

  • is the user known?
  • has the user already performed this particular action?
  • has the user already performed this particular action in this time interval?
  • has the user already performed this particular action on this host?
  • how do other users behave about this particular action?

The purpose of this analysis, as said, is to define if a behavior can be considered ’normal’. All the different algorithms applied to the historical data, will define the score (risk level) that will be assigned to the user.

UBA Configurations

Only few parameters can be modified to fine tune the user behavior analysis algorithms. In the “advanced options” section, you can:

User Behavior Analytics

  • enable or disable the learning mode. If unchecked the learning mode is disabled, and the analysis will be performed. If you enable this flag you should also define an expiration date of the learning mode, when the learning mode will be automatically disabled. If you enable this flag with few events it is possible that you start receiving a lot of warning messages, since there’s no history.
  • define an email address that will receive all the messages coming from the behavior analysis
  • by default everything that happens during the last (by default) 15 days represent the analysis base. Meaningful values varies from 15 to 30 days
  • You can define a retention time for the users baseline. This is generally two times the analysis base and the acceptable range is between the analysis base value and 60.
  • last option represents the minimum percentage beyond which the event is considered to be at risk.

You can also specify with events are involved in UBA by enable them in LM > User Behavior Analytics.
Here is also required to select the User Parameter.
User Behavior Analytics

Dashboards
Results should be accessed by dashboards. The application will deploy four new dashboards called “User Behavior Analytics – *”. Please take a look at the dashboards and don’t forget that while the application is in learning mode, nothing will be displayed.
The application also enables a new widget called “User Behavior analytics”. You can create your own dashboards by mixing different views enabled by this widget.
User Behavior Analytics

Lists
The application will modify also the Lists view (SCM > Actions > Lists) by adding a new column called “UBA”. When a list file is selected, this will be used in the user behavior analysis application to match the current user with other users. List file should contain a set of users that should belong to the same group (or role) of the current user. You can use a group to include and/or exclude a user from a group. If both include and exclude flag are selected, the list is used first as an include list and if there is no match, it will be used as an exclude list (compare user behavior against users not present in that list).

]]>