With ironsyslog we present a new IF-MAP client that acts as a bridge between Syslog and IF-MAP.
Developed during the SIMU research project, ironsyslog acts as a Syslog relay server that puts incoming log messages through complex event processing (CEP), whose rules then map the messages onto IF-MAP identifier and metadata, that are published to a MAP server in the end.
The first demo, created in cooperation with DECOIT GmbH, presents an approach to build a SIEM system with IF-MAP based components. This demonstration contained results of the completed research project VisITMeta as well as from the still ongoing SIMU project.
The second demo was put together with Pulse Secure and DECOIT GmbH, integrating components from all three vendors to demonstrate a BYOD scenario, where all components work together to monitor a smartphones behaviour once connected to a company network and take automatic actions when behaving in a bad way.
As last year, the conference was a great opportunity to get in contact with people interested in network security in general and IF-MAP in particular.
There were again some great talks and panels with security experts like Bruce Schneier, Adi Shamir and Whitfield Diffie (as for example in this great panel), as well as some inspiring keynotes featuring both prospects of network security’s future and talks on (more or less) unrelated topics.
Here are some general impressions of the city of San Francisco (luckily shot at better weather conditions compared to last years attendance).
05 May 2015
Meet the Trust@HsH team at the RSA conference 2015 in San Francisco
It will be held at the Moscone Convention Center (West) in the room 2002/2006.
We will be participating at 2 out of the 20 different demonstration booths, showcasing our IF-MAP tools, like the MAP server irond or the visualisation client VisITMeta in collaboration with tools from other vendors like DECOIT or Pulse Secure.
The Trust@HsH team will be happy to welcome you at our booths titled BYOD Solutions Well in Hand: Standards-Based Mobile Security and Near Real-Time Network Security with an IF-MAP-Based SIEM Approach!
16 Apr 2015
Bugfixes for VisITMeta
We released two bugfixes for our IF-MAP visualization software VisITMeta, so the current version is 0.4.2.
Wrong rendering of links between vendor-specific metadata
Wrong behavior when changing colors of metadata nodes and selecting single nodes
08 Apr 2015
VisITMeta 0.4.0 released
Our IF-MAP visualization software VisITMeta has been released in version 0.4.0.
It features the following changes:
Search functionality: it is now possible to search for metadata and identifier nodes within the GUI, by using a very simplistic search “language”
New history navigation via tabs for live, history and delta view
Support for metadata published via the notify operation (only accessible via the REST interface at the moment)
Now using of ironcommon, our new utility library for ifmapj-based projects
Integration of Checkstyle plugin into our Maven build environment
Modified Maven pom.xml so that running VisITMeta within Eclipse should now be possible
Some minor bugfixes
The screenshot shows the new search functionality via searching for all nodes containing ip and 10.0.0 as well as all nodes exactly matching device; all nodes that do not match the search string are rendered slightly transparent. The screenshot also shows the new tab-based control over history navigation.
With Metalyzer we introduce a software, that allows to analyse IF-MAP data for statistic and semantic features.
Metalyzer consists of two separate modules:
a module that can be loaded by the dataservice application of VisITMeta, that performs the analysis on MAP data and provides REST-like access to the results
a visualization client that presents these results via tables, charts and other diagrams.
Some of the analysis that can be done with Metalyzer include the absolute and relative frequencies of different identifiers and metadata or an overview of associated IP addresses and MAC addresses, found by following a given path in the IF-MAP graph data.
The statistic analysis is partly done by using the R framework, whereas the visualization via charts and diagrams uses the JFreechart library.
Metalyzer was developed by a group of 9 students during their bachelor studies within two terms at the Hochschule Hannover.
Please find the sourcecode and instructions on how to build Metalyzer and include it in a VisITMeta runtime environment in the projects Github repository.
In combination with the release of Metalyzer in its first version we also release VisITMeta in version 0.2.0.
The main feature of this version is the added support for external modules - like Metalyzer - , to allow arbitrary processing on the stored MAP data.
We also fixed a bug that happened when the delta is calculated after a single value metadata was updated, and added the possibility to select and unselect single nodes in the GUI application.