Cloud-based log alerting and incident management

The need for security alerts

All too often, organizations realize they've been breached weeks or months after an attack; the primary reason for this "breach dwell time" being so high is the lack of effective security monitoring measures. In the wake of security incidents, alerts can mean the difference between a safe network and a breached one. It's vital for security teams to monitor logs and set up alerts, which act as tripwires in their network. As an attacker moves around the network, they will inevitably set off an alarm, notifying the security team of the threat.

Examples of security alerts

Consider the following scenarios:

• A new software or service is installed on a critical server
• A host is restarted unexpectedly
• A firewall policy is modified
• An application crashes
• An important policy, such as the logging policy, is altered

Such events are known as indicators of compromise (IoCs), and must be flagged and investigated to detect a security threat before it's too late. By setting up alerts for multiple IoCs in your network, you can maximize the chance of detecting security threats.

Managing the incident

Once an alert has been raised, it must be resolved quickly to reduce the time a malicious actor has to carry out an attack. Swift investigation and response can curb an attack at an early stage. Security teams must ensure that they have an accountable process in place to attend to every alert raised by their monitoring tool. This involves defining rules so alerts get automatically assigned to the appropriate administrators in order to reduce the time it takes to respond to the incident. For example, an alert raised on the SQL server must be pushed to the SQL administrator automatically, rather than calling the administrator much later to inform them about the incident.

Log360 Cloud's alerting module

Log360 Cloud is a cloud-based log management solution that can monitor and secure your network. Log360 Cloud allows you to trigger and manage alerts for security events of interest to detect attacks at an early stage. The solution comes with three categories of alert profiles:

• Predefined alerts: Log360 Cloud allows you to choose from a range of predefined alert profiles that address common security use cases. This makes it easy for security teams to set up alerts right after deploying the solution.
• Compliance alerts: The solution comes with out-of-the-box sets of compliance alerts profiles that help you comply with regulations such as the PCI DSS, HIPAA, SOX, and more.
• Custom alerts: You also have the option to define your own alerting criteria as per your requirements by defining conditions and combining them with logical operators.

Centralized management of incidents with Log360 Cloud

Log360 Cloud's interface allows you to manage all the alerts from within the console; these alerts can be assigned to administrators manually or automatically by defining assignment rules. The status of an alert can be updated from open to in progress to closed to track its resolution.

Additionally, Log360 Cloud can be integrated with help desk tools such as ManageEngine ServiceDesk Plus, ServiceNow, Zendesk, and Kayako. This way, alerts can be raised as tickets on the central help desk tool to streamline the process of incident management.