Premierowy pokaz systemu Sentinel 7. Dariusz Leonarski Senior Consultant, Novell/NetIQ

Wielkość: px

Rozpocząć pokaz od strony:

Download "Premierowy pokaz systemu Sentinel 7. Dariusz Leonarski Senior Consultant, Novell/NetIQ dleonarski@novell.com"

Judyta Nowicka
8 lat temu
Przeglądów:

1 Premierowy pokaz systemu Sentinel 7 Dariusz Leonarski Senior Consultant, Novell/NetIQ dleonarski@novell.com

2 NetIQ w Polsce Novell Sp. z o.o. krajowym reprezentantem interesów całego holdingu The Attachmate Group 2 W ramach holdingu działają niezależne jednostki biznesowe NetIQ Novell SUSE Attachmate Co zapewnia polskie biuro? Lokalna pomoc i konsultanci Konkurencyjność cenowa produktów i usług Dbałość o relacje i serwis

3 Emulacja terminali Modernizacja systemów Transfer zarządzanych plików Zapobieganie oszustwom w firmie Novell Sp. z o.o. ul. Postępu Warszawa tel infolinia Praca grupowa Usługi sieciowe i plikowe Zarządzanie punktami końcowymi 3 Zarządzanie tożsamością, bezpieczeństwem i zgodnością Zarządzanie systemami Zarządzanie zasobami Serwery Linux dla firm Wirtualne urządzenia (software appliances) Linux na desktopie

22 537 5000 infolinia 800 22 66 85 Praca grupowa Usługi sieciowe i plikowe Zarządzanie punktami końcowymi 3

4 Attachmate Reflection products Novell Identity Manager Novell GroupWise Novell Access Manager Novell Vibe OnPrem Attachmate EXTRA! products Novell Access Governance Suite Novell Vibe Cloud Attachmate INFOConnect products Novell Sentinel Attachmate DATABridge NetIQ Change Guardian products Attachmate FileXpress products Novell SecureLogin Attachmate Luminet Novell Cloud Security Service Attachmate Verastream products NetIQ Security Manager Novell File Management Suite Novell Data Synchronizer Novell ZENworks Configuration Management SUSE Linux Enterprise Server for System z SUSE Linux Enterprise High Availability Extension SUSE Linux Enterprise Real Time Extension Novell ZENworks Patch Management SUSE Linux Enterprise Point of Service Novell Cloud Manager Novell ZENworks Asset Management Novell Compliance Management Platform SUSE Linux Enterprise Server with Expanded Support Novell ZENworks Application Virtualization Novell Privileged User Manager Novell Operations Center NetIQ Directory and Resource Administrator Novell ZENworks Linux Management SUSE Linux Enterprise Server for SAP Applications SUSE Linux Enterprise Desktop NetIQ Migration Suite Novell ZENworks Virtual Appliance SUSE Manager NetIQ Secure Configuration Manager Novell ZENworks Endpoint Security Management SUSE Studio NetIQ AppManager Suite Novell Service Desk NetIQ AppManager Performance Profiler LibreOffice Novell Open Workgroup Suite NetIQ Analysis Center NetIQ Aegis PlateSpin products 4 Novell Open Enterprise Server SUSE Linux Enterprise Server

SecureLogin Attachmate Luminet Novell Cloud Security Service Attachmate Verastream products NetIQ Security Manager Novell File Management Suite Novell Data Synchronizer Novell ZENworks Configuration

5 Sentinel 7 Overview

6 Extensive Product Enhancements and Differentiation in Sentinel 7 Completely refreshed, web-based user interface Industry-first Security Intelligence/Anomaly Detection with advanced data analytics 6 Bundling of Log Management Features New correlation rule builder Single product that includes a soft appliance option Extensive public REST APIs to core components

advanced data analytics 6 Bundling of Log Management Features New correlation rule builder

7 New User Interface 7

8 What s Happening In My Environment? Anomaly Detection Discrepancy or deviation from an established rule, trend, or pattern Something I can t necessarily foresee but I want to monitor Correlation Relationship between two or more sets of data Something I can foresee and want to take immediate action 8

trend, or pattern Something I can t necessarily foresee but I want to

Security Intelligence Anomaly Detection Anomaly detection is more effective to discover new attacks and identify threats without building rules 9 Quickly detect anomalies by analyzing when the

9 Security Intelligence Anomaly Detection Anomaly detection is more effective to discover new attacks and identify threats without building rules 9 Quickly detect anomalies by analyzing when the environment changes Correlation is extremely effective but you have to know what to look for ahead of time Security Intelligence delivers value day one, without building correlation rules Complements correlation rules

environment changes Correlation is extremely effective but you have to know what to look for ahead of

10 Security Intelligence Dashboards 10

11 Security Intelligence Dashboards 11

Correlation Overview Realizing the full value of the Sentinel correlation 12 Easily build, manage and maintain correlation rules without the complexities of writing RuleLG or understanding Sentinel

12 Correlation Overview Realizing the full value of the Sentinel correlation 12 Easily build, manage and maintain correlation rules without the complexities of writing RuleLG or understanding Sentinel taxonomy Build and update correlation rules from existing events Test new/modified rules before putting them into production Understand the impact on system performance for each individual correlation rules Overall performance monitoring and metrics of the Correlation engine Easily integrated with Security Intelligence

events Test new/modified rules before putting them into production Understand the impact on system performance for each

13 Correlation Rule Building 13

14 Correlation Rule Building 14

15 Correlation Rule Builder 15

16 Identity Integration Building on the strengths of Sentinel Industry unique integration of identity details with security events collected from provisioned applications Basic out-of-the-box integration with Microsoft Active Directory Integration with Identity Manager with other Identity Management systems in the future User Activity Monitoring allows security and compliance managers to understand the what, when, how and who of Identity and Security

Basic out-of-the-box integration with Microsoft Active Directory Integration with Identity Manager with other

17 Identity Integration 17

18 Identity Integration - Activity What applications has this user been using? What actions have they been performing in those applications? What privilege changes has been? 18

19 New Identity Search 19

20 What s Come over From Sentinel Log Manager? An integrated Log Management and SIEM product Still two separate products each with different uses/use cases Distributed Search Search data across Sentinel and Log Manager servers Tagging Tagging has been incorporated into Anomaly Detection Users and Roles LDAP Authentication Data Retention Policies One-Click Reporting 20

different uses/use cases Distributed Search Search data across Sentinel and Log Manager

21 Report White Labeling 21

22 Two-Tiered Storage Architecture 22

23 Data Synchronization Data Synchronization automatically or through policy moves event data from the file system store to the embedded or 3rd party database Data that is needed for reporting is automatically moved to the database Custom policies can be defined that allow data to be synchronized to the database 23 Data that is synchronized is based upon a Filter Query Sentinel 7 includes an embedded database Depending on customer needs, optional support for Microsoft SQL Server 2008 and Oracle 11g

24 Data Synchronization Policy 24

25 Summary of new features 25 Anomaly Detection - Create baselines of 'normal' behavior in your IT environment to allow for detection of anomalous activities Unified Single Solution - Log management and event management capabilities are combined in a single unified product High Performance Two-Tiered Storage - Efficient, file-based event storage tier is optimized with 10:1 compression for long-term archival of events while allowing the flexibility to sync events to a traditional relational database Graphical Rule-Builder - Quickly build and test event correlation rules using the events collected in your environment to deliver improved threat detection capabilities Distributed Search - Search events not only on local Sentinel servers but also on other Sentinel or Sentinel Log Manager servers from a single, centralized console Optional Ready-to-Run Software Appliance - Delivered as a VMWare, Xen or ISO image, and supported on the major hypervisors, including Hyper-V

26 Spojrzenie od strony handlowej...

27 Licencjonowanie systemu Sentinel 7 Enterprise Events Per Second (EPS) Licensing Model Liczymy wyłącznie liczbę zdarzeń w środowisku IT Nie ma oddzielnych licencji na serwer Sentinela, konektory czy moduły korelacji zdarzeń Szczegóły na Infolinia handlowa infolinia@novell.pl Zamówienie indywidualnej oferty , 1.000, 2.500, 5.000, , , EPS

28 Nagrody za ankiety Zapraszamy na kolejne webinary 15 listopada ZENworks Config. Management SP2 24 listopada ZENworks Patch Management PL Rejestracja: Podziel się opinią o dzisiejszym naszym seminarium 28 Link do formularza z ankietą prześlemy jeszcze dzisiaj razem z linkiem do nagrania webinaru Wśród respondentów rozlosujemy trzy praktyczne klucze USB 4GB Your Key to Security

29 29

30 Pytania? (zanim przejdziemy do pokazu...)

31 Demo

Adres centrali 1233 West Loop South Suite 810

Corporation. All rights reserved. +1 713.548.

33 This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in or changes to the software described in this document at any time. Copyright 2011 NetIQ Corporation. All rights reserved. ActiveAudit, ActiveView, Aegis, AppManager, Change Administrator, Change Guardian, Compliance Suite, the cube logo design, Directory and Resource Administrator, Directory Security Administrator, Domain Migration Administrator, Exchange Administrator, File Security Administrator, Group Policy Administrator, Group Policy Guardian, Group Policy Suite, IntelliPolicy, Knowledge Scripts, NetConnect, NetIQ, the NetIQ logo, PSAudit, PSDetect, PSPasswordManager, PSSecure, Secure Configuration Manager, Security Administration Suite, Security Manager, Server Consolidator, VigilEnt, and Vivinet are trademarks or registered trademarks of NetIQ Corporation or its subsidiaries in the United States.

Podobne dokumenty

Disaster Recovery z PlateSpin Forge. Jedno narzędzie do zabezpieczania serwerów fizycznych, wirtualnych i chmury!

Disaster Recovery z PlateSpin Forge Jedno narzędzie do zabezpieczania serwerów fizycznych, wirtualnych i chmury! Tomasz Surmacz Sales Director Dariusz Leonarski Senior Consultant Rodzina rozwiązań PlateSpin