Configure SEM audit policy information

Configure Security Event Manager (formerly Log & Event Manager) audit policy.

I have installed/deployed SEM, now what? (after activation of license and ‘activate’ command)
 

• Let’s get network devices (syslog or SNMP) sending data to the SEM.
• Configure connectors in SEM to receive the syslog data
• Install Windows/Linux/Unix agents to send data, and set/verify connectors for desired logs.
• Verify SEM is configured correctly to receive the volume of traffic, and the data is going into the database.
• Configure rules to act upon the specific types of data.

I’m sending data but what is the correct data?

Set up Windows auditing as you choose, but if you are under any compliance, we encourage you to follow the recommendations of your auditor (and your internal security/management policies), or at least our set of PCI auditing recommendations. Included at the bottom of this article are both PCI auditing recommendations and WFP (Windows filtering platform) settings.
 

Use the following for a basic understanding: Audit policies and best practices for SEM

Important:  If you follow the PCI auditing at the bottom of this article, you will also be disabling the WFP noise. To verify/set Windows auditing, use the PCI auditing as a baseline.

What about File Auditing?

We have always seen issues about file auditing (which falls under object auditing), but the FIM connector makes it easier to audit too much. Audit only what is NEEDED, not everything under the C drive, which can overwhelm SEM. Two ways to enable file auditing (do one or the other, not both):
 

• Under group policies, enable File Auditing, and then configure the FIM connector (easiest way).
  • File Integrity Monitoring
  • Configure FIM
• Under group policies, enable File Auditing, and then manually enable the audit settings.
  • Enable File Auditing in Windows

(Right-click a directory folder and select Properties. Click the security tab, and then click Advanced. In the pop-up window, click the Auditing tab, click Edit, and then add the auditing desired, allowing the setting to push down through directories as desired.)

“RSOP” (technically rsop.msc) worked great for windows 2003, but was deprecated by Microsoft because it does not pick up some of the audit policies in Windows Vista and newer (includes 2008/2012). If you run it, you may need to search the C drive for the command, but do not expect it to show the GAP (granular audit policies), commonly referred to as advanced audit policies.

GPresult (gpresult.msc) has replaced RSOP for Windows 2008/2012, and has several attributes to help with displaying the policies. 

gpresult [/s <COMPUTER> [/u <USERNAME> [/p [<PASSWORD>]]]] [/user [<TARGETDOMAIN>\]<TARGETUSER>] [/scope {user | computer}] {/r | /v | /z | [/x | /h] <FILENAME> [/f] | /?}

From a Windows server, use “gpresult /h rsop-gpresult.htm” for graphical, but note the command has other capabilities.

You can still look at the individual active directory group policies using Active Directory Users and Computers, or Group Policy Management Console. One of the two should be loaded on a DC or PC/server that has the management applications installed.
 

To use the GAP (advanced audit policies), you either need to enable the GPO setting in AD policies or set it on the local computer.
 

• AD-Users and Computers or GPMC or Gpedit or Local Policy Editor
  • (Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Force Audit Policy Subcategory Settings)
• Regedit à HKLM\System\CurrentControlSet\Control\LSA   à set for 1 to enable the GAP

The agent is needed on every active directory Domain Controller (DC) to receive data from the security event log. Events like a user logon and changes in AD are picked up on only one DC, even though the information is securely replicated between domain controllers (which we do not see). Occasionally we do see duplicate events (a single event sent by two different domain controllers), but this is typically caused by event logs being replicated between DC’s. Something we never saw in 2003.
 

Here is the information on Windows noise (Windows Filtering Platform noise).
 

• Windows Filtering Platform (WFP) is a new architecture that enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). KB1676.
• Some Windows Filtering Platform (WFP) events have been deemed as 'noise', because we have never found any value in these events.
• These are TCP/IP/PPTP/UDP/ICMP events ending in 515x (5152, 5154, 5156, 5157, 5158, 5159) as identified in the EventID, which we call the ProviderSID.
• When you search the internet for this log data, please let us know if you find any value in these events from Windows Vista and newer operating systems.
• Because of the volume of WFP traffic, Windows security-event logs can fill up quickly. This traffic is traversing your network, and can occupy up to 90 percent of the database capacity in SEM.
• Noise is removed by enabling sub-category level auditing (which disables category level), enable desired auditing and disabling 9-subcategories within the advanced auditing.

Here are the 9 sub-categories to be disabled (no auditing)
 

• MPSSVC Rule-Level Policy Change
• Filtering Platform policy change
• IPsec Main Mode
• IPsec Quick Mode
• IPsec Extended Mode
• IPsec Driver
• Other System Events
• Filtering Platform Packet Drop
• Filtering Platform Connection

Windows 2008 Windows Filtering Platform noise tuning information:
 

• The Windows Filtering Platform (WFP) VS.85 (© 2017 Microsoft, available at https://msdn.microsoft.com, obtained on January 10th, 2017.)
• How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain (© 2017 Microsoft, available at https://support.microsoft.com, obtained on January 10th, 2017.)
• What's New In Windows Security Auditing (© 2017 Microsoft, available at https://technet.microsoft.com, obtained on January 10th, 2017.)
• Eliminate Windows Firewall Chatter (Noise) from the Security Log (Ultimate Windows Security Blog) (© 2006-2017 Monterey Technology Group, Inc., available at https://www.ultimatewindowssecurity.com, obtained on January 10th, 2017.)

The best way to reduce WFP noise is to change active directory group policies (GPO's) to remove these events at the source, especially in the DC's:
 

• SEM Manager crashes after a high number of alerts from Windows 7 or Windows Server 2008

You can also reduce WFP 'noise' received into the LEM appliance using "Event Distribution Policy", but the LEM still consumes additional resources to process these events:

• Disable Windows Filtering Platform Alerts Using Alert Distribution Policy

Check/view how the category/sub-categories are set (applicable to Windows Vista and newer operating systems):

cmd-line: auditpol /get /category:* or 

cmd-line: auditpol /get /category:"policy change","logon/logoff","system","Object Access"

view Category-level auditing in gpedit/policy-mgmt: Computer-Config,Windows-Settings,Security-Settings,Local-Policies,Audit-Policies. or

view Sub-category-level auditing in gpedit/policy-mgmt: Computer-Config,Windows-Settings,Secutity-Settings,Advanced-Audit-Policy-Config,Audit-Policies.

Enable/Force subcategory use:
 

(to view) Local-Security-Policy: Local-Policies, Security-Options, Audit:Force-audit-policy-subcategory-settings==> enabled

(to set) GPMC: Computer-Config,Windows-Settings, Secutity-Settings, Local-Policies, Security-Options, Audit:Force-audit-policy-subcategory-settings==> enabled

Note: When enabling the "force sub-category", this sets the sub-category auditing to be enabled and the category-level-auditing to be disabled.

Manually set Auditing level (removes the following 9-subcategories) command to set on auditing locally: (can be set using cmd-line, but GPO's will overwrite)

auditpol.exe /set /subcategory:"MPSSVC Rule-Level Policy Change","Filtering Platform policy change","IPsec Main Mode","IPsec Quick Mode","IPsec Extended Mode","IPsec Driver","Other System Events","Filtering Platform Packet Drop","Filtering Platform Connection" /success:disable /failure:disable

Use Group Policy Management Editor to set policies to disable the 9-subcategories, in the domain/site/OU, whichever is applicable.

You may also see additional WFP noise from -->  Other Policy Change Events ==> EventID 5447

We cannot disable these events without possibly missing some desired events that you may want logged.

Windows 2008 Auditing (MSDN) (© 2017 Microsoft, available at https://msdn.microsoft.com, obtained on January 10th, 2017.)

Additional events that may be reduced within the SEM can also be tuned out under the Event Distribution Policy.

If you do not care about machine-level authentication events or the policy-scope-change events, we suggest tuning them out. Disable Windows Filtering Platform Alerts Using Alert Distribution Policy

On the SEM Console toolbar, navigate to Manage > Appliances, select Policy from the gear on the left, and then uncheck the console/database/warehouse/rules check boxes:

• Machine Logon: Generic Alert > Audit Alert > Auth Audit > Machine Auth Audit.
• Machine Logoff: Generic Alert > Audit Alert > Auth Audit > Machine Auth Audit.
• Machine Auth Ticket: Generic Alert > Audit Alert > Auth Audit > Machine Auth Audit.
• User Auth Ticket: Generic Alert > Audit Alert > Auth Audit > User Auth Audit.
• Policy Scope Change: Generic Alert > Audit Alert > Resource Audit > Policy Audit > Policy Access.