MetaFlows @metaflows - Tumblr Blog

Search In Packet Logs

You can now search for arbitrary strings in the historical packet logs directly. The only requirements for this search is at least 1 IP address in addition to the search string.

For example in the search below we are looking for the IP address 139.182.44.203 in any packet either sent or received by the host 23.208.142.28. The search is also restricted to an hour worth of packets on 5/7/2018.

So…

View On WordPress

Websockets in server mode

You can now use Websockets and disable flash for good. We added support for Websockets instead of Flash for direct real time connection to our sensors to retrieve real time data and payloads. Sensors can be configured in client mode or server mode. In client mode sensors and browser both connect outbound as clients and get connected at the network level by our forwarder. Websockets have been…

View On WordPress

Proxy Detection Support

This has been awaited for some time. The MetaFlows Security System now detects proxied connections. The original IP is swapped with the proxy IP so that it can be correctly identified in the events. This has a dramatic effect on correlation since most proxied hosts only proxy http and use their real IP for DNS and other communications. Using the real IP for correlation and analysis will correctly…

View On WordPress

Splunk App

We have developed a Splunk network security app available at https://splunkbase.splunk.com/app/3603

or http://nsm.metaflows.com/SplunkforMetaFlows.tgz.

It receives events generated by the MetaFlows sensors and breaks them down by the following types:

Multisession Analysis

High Priority Events

IDS Events

Network Logs (3rd party logs sent to the sensors)

File Transmission Analysis

User Discovery

Se…

View On WordPress

Watch your MACs

We added a feature to alert you whenever a new MAC address is seen by the system. The system learns about MAC addresses either through analyzing the DHCP protocol or finding new MAC addresses in the normal network traffic (if you are mirroring/spanning the endpoints’ MAC addresses).

It generates messages of the form:

MACwatch

Every time the system sees a new MAC address.

Where: IP_ADDRESSis the…

View On WordPress

WannaCry Ransomware Advisory

It has been all over the news this weekend, a surge in Ransomware under the name ‘wannacry’ that has the potential to cripple large portions of networks due to the way that it spreads.

This is a pretty stealthy piece of malware at the network level, little to no CnC has been confirmed, but at an individual level it doesn’t behave much differently from any other Ransomware that we have seen in the…

View On WordPress

Watch your MACs

We added a feature to alert you whenever a new MAC address is seen by the system. The system learns about MAC addresses either through analyzing the DHCP protocol or finding new MAC addresses in the normal network traffic (if you are mirroring/spanning the endpoints’ MAC addresses).

It generates messages of the form:

MACwatch <IP_ADDRESS> <MAC_ADDRESS> <Flow information>

Every time the system…

View On WordPress

Got MAC?

We recently added the MAC addresses to the event messages. The system gets the MAC addresses in two orthogonal ways:

We sniff the MAC headers from the passive tap. If the MSS sees more than 5 IP addresses with the same MAC, it stops recording because it means you are mirroring the connection between the switch and the next routing hop (probably the firewall) where the MAC addresses are not…

View On WordPress

Websockets Are Here

Adobe Flash is one of the original sins. It is everywhere and yet it is a huge security risk. Websockets is an HTML5 standard that, for us, provided an alternative to Adobe Flash.

For now we support both. The browser will try to use Adobe Flash first, and if it is not present or it is disabled, it will try using Websockets (which are hard-coded in your Browser). I you want to keep using Adobe…

View On WordPress

Constant Companions: Giving Passwords and Passphrases Thier Due

“Through 20 years of effort, we’ve successfully rained everyone to use passwords that are hard for humans to remember, but are easy for computers to guess.” Randall Monroe, XKCD

For users, passwords and passphrases are a way of life. How else can an individual not only identify themselves to access necessary services but also prove that they are who they say they are without biometrics? …

View On WordPress

Product Update: Reconsider Event Classifications

Recently, the engineers at MetaFlows have improved the Event Classification Menu within the MetaFlows software, allowing each user to further customize events through actions and event views. This introduces four key features to the Event Classification Menu that users will find helpful in employing the MetaFlows IDS.

The first improvement allows users to see a comprehensive list of their…

View On WordPress

#IDS

Taking a Crack at Locky

Since mid-February, security researchers have been encountering Locky, the latest ransomware tool in the adversary’s arsenal. The engineers at MetaFlows observe Locky primarily in email attachments that are processed using the MetaFlows sandbox. On networks being monitored by MetaFlows sensors, the engineers are able to take samples of inbound .zip email attachments and send them to a Cuckoo…

View On WordPress

#Locky #Network Security #Ransomware

Feature Highlight: Snort Rule Editor

Recently, the Snort Rule Editor as a part of the Rules Management Interface has been updated. This redesign allows for increased flexibility and provides the user with more of a handle on the IPS rules settings.

How It Works

Entering the Rules Management Interface is easy and can be accessed from two possible locations. From the View Sensors page, the user can select the Edit Rules link to…

View On WordPress

#IDS #snort

Uncovering True Positives

MetaFlows is now using our sandbox results as an intelligence feed for ranking events. This method of using the sandbox as an intelligence source for ranking signatures allows us to catch infections or high-risk behavior, even if we only see one piece of the traditional malware life cycle. The picture below illustrates a sandbox report that shows where the signature was first observed in…

View On WordPress

FireEye Foibles

On February 15th, Blue Frost Security released a statement regarding an analysis engine evasion that was identified in regards to FireEye’s virtualization-based dynamic analysis. Their statement reads, “An analysis engine evasion was identified which allows an attacker to completely bypass FireEye’s virtualization-based dynamic analysis on Windows and whitelist arbitrary malicious binaries.”

We…

View On WordPress

Predictive Global Correlation Feed

After months of data gathering, we turned on a new global correlation feature to complements the existing local multi-session correlation. The aim is to further tighten the net and catch more bad stuff without increasing false positives.

We now show the ranking as total/globalwhen we display an alert. When the global ranking is missing, it is because that event is only ranked locally and the…

View On WordPress

The Skinny on CVE-2015-7547

While the DNS exploit CVE-2015-7547 was discovered a week ago, the code containing the flaw has been in use since May, 2008. CVE-2015-7547 works by allowing arbitrary code to execute on any system reliant on glibc by way of a malformed query response. As discovered by Redhat Linux and Google, there are flaws in GNU C Library. The GNU C Library connects to DNS to resolve names. This problematic…

View On WordPress

Trending Blogs

Recently Viewed Blogs

MetaFlows