3.1 Understanding Correlation

Sometimes, an event viewed in the system might not necessarily draw your attention. But, when you correlate a set of similar or comparable events in a given period, it might lead you to an alarming event. Sentinel helps you correlate such events with the rules you create and deploy in the Correlation engine and take appropriate action to mitigate any alarming situation.

Correlation adds intelligence to security event management by automating analysis of the incoming event stream to find patterns of interest. Correlation allows you to define rules that identify critical threats and complex attack patterns so that you can prioritize events and initiate effective incident management and response. Starting with Sentinel 6.0, the correlation engine is built with a pluggable framework, which allows the addition of new correlation engines in the future.

Correlation rules define a pattern of events that should trigger, or fire, a rule. Using either the correlation rule wizard or the simple RuleLG language, you can create rules that range from simple to extremely complex, for example:

Two or more of these rules can be combined into one composite rule. The rule definition determines the conditions under which the composite rule fires:

After the rule is defined, it should be deployed to an active Correlation Engine, and one or more actions can be associated with it. After the rule is deployed, the Correlation Engine processes events from the real-time event stream to determine whether they should trigger any of the active rules to fire.

NOTE:Events that are sent directly to the database or dropped by a Global Filter is not processed by the Correlation Engine.

When a rule fires, a correlated event is sent to the Sentinel Control Center, where it can be viewed in the Active Views window.

Figure 3-1 Active View window

The correlated event can also trigger actions, such as sending an email with the correlated event’s details or creating an incident associated with an iTRAC workflow.

3.1.1 Technical Implementation

All correlation is done in-memory on the machine (or machines) that host the correlation engine. This model allows fast, distributed processing that does not contend with database operations such as inserting events into the database.

For environments with large numbers of correlation rules or extremely high event rates, it might be advantageous to install more than one correlation engine and redeploy some rules to the new correlation engine. The ability to deploy multiple correlation engines provides the ability to scale as the Sentinel system incorporates additional data sources or as event rates increase.

Sentinel’s correlation is near real-time and depends on the timestamp for the individual events. To synchronize time, you can use an NTP (Network Time Protocol) server to synchronize the time on all devices on your network, or you can rely on the time on the Collector Manager servers and synchronize only those few machines.

Correlation relies on the data that is collected, parsed, and normalized by the Collectors, so a working understanding of the data is necessary to write rules. Many Novell correlation rules rely on an event taxonomy that ensures that a “failed login” and an “unsuccessful logon” from two devices are classified the same.

In the Correlation tab, you can:

  • Create/Modify Correlation rules and rule folders

  • Deploy Correlation rules on Correlation Engine

  • Create and associate an action to a rule

  • Configure Dynamic lists

NOTE:Access to the correlation functions can be enabled by the administrator on a user-by-user basis.