-
500 items
1 item
11 item
13 item
169 item
9 item
88 item
213 item - For developers
The release 4.2 rebrands Galaxy Threat Acceleration Program to ArcSight Threat Acceleration Program (GTAP to ATAP) and exchanges all CyberRes references for ArcSight. Additionally, 4.2 adds new content to the Security Threat Monitoring and Threat Intelligence Platform packages to help you monitor command obfuscation, exfiltration to text storage sites, Suspicious API activity, and communication to malvertising publishing domains/IPs.
The release 4.1 contains 12 new rules in the Security Threat Monitoring package to detect more cyber security attacks for the Windows Operating System, and added 3 new rules in the Threat Intelligence Platform package with very high confidence, and an active channel to display the very high confidence alerts. It also updated 8 rules.
"ArcSight ESM Default Content 4.0" release is a milestone release for the entire ArcSight portfolio.
In this release, the primary focus has been to support "CyberRes Galaxy Threat Acceleration Program (GTAP)" version 2.0. This is done through the "Threat Intelligence Platform" sub-package of the ESM Default Content package.
As you may read more from GTAP 2.0 Release Notes, ArcSight's Threat Intelligence support that is built-into ESM and the Default Content has been significantly improved. The most signifant change has been the introduction of many additional fields to have a richer feed with more SOC-ready context.
As such, Active Lists hosting the realtime IoC information, that are received from the realtime threat intel feed, as well as the rules/filters and other resources that utilize these active lists have been considerably updated.
As this was a significant change in the way the ESM resources worked, "deployment of ESM Default Content 4.0" now requires a couple extra steps that are specific to this release.
Please read this document in full, and preferably watch the following video, to get yourself acquantied with the process.
The release 3.7 contains 9 new rules in the Security Threat Monitoring package to help protect Windows, AWS Security Hub, and Microsoft Office 365 environments [or] applications. It also contains 3 new rules and a new dashboard to help you monitor the health of the CyberRes Galaxy Threat Acceleration Program (GTAP)1.0 Basic and Plus Model Import Connector. This release also contains 14 updated rules with more fields in the aggregation tab.
In the release 3.6 22 new rules were added and 2 rules were updated to support MITRE ATT&CK Cloud Techniques for AWS Security Hub log source and Microsoft Office/Defender 365
In the release version 3.5, 15 new rules were added to support MITRE ATT&CK Cloud Techniques for Microsoft Azure Services
In the release version 3.4, 11 new rules were added to detect possible APT Malware and 0-day attacks, which will be triggered when the base event matches an entry in the Threat Intelligence active lists and where the threat level is Medium or High. A new active channel has been added for monitoring those rules.
In the release version 3.3, we added 7 rules to cover MITRE Techniques under two new MITRE Tactics - TA0042 Resource Development and TA0043 Reconnaissance.
In the release version 3.2, we added 3 rules to cover more MITRE ATT&CK Techniques/sub-Techniques.
In the release version 3.1, we added 77 rules to cover more MITRE ATT&CK Techniques/sub-Techniques.
In the release version 3.0, we have re-mapped the existing Default Content to support the new MITRE ATT&CK sub-techniques.
As a result of this re-mapping exercise, the Default Content now supports the techniques and sub-techniques listed below.
For a more user-friendly way of browsing this list, we recommend you to visit https://mitre.microfocus.com/.
We also provide a downloadable JSON formatted file of all Default and Non-Default Content on the above-mentioned webpage.
Threat Intelligence Platform
This package is designed to detect security threats based on intelligence data feed. It also follows the MITRE ATT&CK framework.
This package requires the installation of MIC for GTAP. For more information on MIC, please refer to the documentation at https://www.microfocus.com/documentation/arcsight/galaxy-gtap-2.0/gtap-2-0-admin-guide/
Following use cases are covered in this package:
System Requirements
========================
Micro Focus ArcSight ESM 7.2 or above.
-------------------------------------------------------------------------------
To install this package:
===========================
The zip file contains three files: package arb file, a signature of arb file, and release note.
Micro Focus provides a digital public key to enable you to verify that the signed software you received is indeed from Micro Focus and has not been manipulated in any way by a third party. Visit the following site for information and instructions:
https://entitlement.mfgs.microfocus.com/ecommerce/efulfillment/digitalSignIn.do
It is required to log in using a Microfocus/Software passport (It gives the option to create an account)
Perform the following steps in the ArcSight Console.
1. Go to the ArcSight Console.
2. Click on Packages
3. Click Import
4. Select package arb file from the zip file
5. Follow the prompts to import and install this package
To upgrade this package from version 3.x
1. Delete /ArcSight Foundation/Threat Intelligence Platform.
Make sure active list group have been deleted from /All Active Lists/ArcSight Foundation/Threat Intelligence Platform.
2. Restart the ESM manager (/opt/arcsight/services/init.d/arcsight_services stop manager, then start manager).
Note: If you do not restart the manager, you will receive an error: Install Failed: "Invalid field name: creatorOrg"
3. Go to the ArcSight Console.
4. Click Packages.
5. Click Import.
6. Select the package .arb from the .zip file.
7. Follow the prompts to import and install this package.
8.After the initial install finishes, right-click Threat Intelligence Platform and click Install Package.
To upgrade this package from 4.0
It is not required to delete the existing package.
1. Go to the ArcSight Console.
2. Click Packages.
3. Click Import.
4. Select the package .arb from the .zip file.
5. Follow the prompts to import and install this package.
To uninstall:
Right-click package from ArcSight Console, then selects "Uninstall Package".
Details in the recent releases
In the release version 4.2 following MITRE IDs were added or rules were added to existing MITRE IDs
T1027.010-Command Obfuscation
T1567.003-Exfiltration to Text Storage Sites
T1059.009-Cloud API
T1583.008-Malvertising
Following resources were added:
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Command Obfuscation Using PowerShell
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Possible Exfiltration to Text Storage Sites
/All Rules/ArcSight Foundation/Security Threat Monitoring/Cloud Monitoring/Suspicious AWS Cloud API Activity Detected
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Outbound Communication to Malvertising Publishing Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Outbound Communication to a Malvertising Publishing Domain
Following resources were updated:
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Linux Auditd Kernel Module Loaded in Critical Server
/All Rules/ArcSight Foundation/Security Threat Monitoring/Network Monitoring/System Network Connections Discovery
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus Very High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus Very High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/No Update from ATAP Connector
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Type
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/ATAP Plus High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Error in ATAP Connector Service Message
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Service Message
/All Rules/ArcSight Foundation/Threat Intelligence Platform/ATAP Connector Health/Track ATAP Connector Update Count
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Internal Domain Found in Suspicious Domains List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Addresses List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Domain List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Hash List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious URL List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Addresses
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Domain
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Email
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious Hash
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/User Defined Reputation Data/Additional Suspicious URL
In the release version 4.1 following MITRE IDs were added or rules were added to existing MITRE IDs
T1003.002-Security Account Manager
T1053.005-Scheduled Task
T1070.001-Clear Windows Event Logs
T1070.009-Clear Persistence
T1486-Data Encrypted for Impact
T1489-Service Stop
T1490-Inhibit System Recovery
T1546.016-Installer Packages
T1552.001-Credentials In Files
T1555-Credentials from Password Stores
Following resources were added:
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credentials Gathered using Mimikatz Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/SystemRestore Task Disabled Using Schtasks
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/File Encrypted Using Encryptor Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credentials In Files
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Specific Processes Killed Using PowerShell Command
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Spearphishing via Whatsapp
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Disable Windows Recovery Using BCDedit Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Deletion of Active USN Change Journal Using Fsutil
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Delete Backups Using WBadmin
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Credential Dumping Using LaZagne
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Event Log Deleted Using Wevtutil Tool
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Program Install
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus Very High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus Very High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email/Email Sent To Suspicious Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/GTAP Connector Health/Track GTAP Connector Type
/All Active Channels/ArcSight Foundation/Threat Intelligence Platform/Very High Confidence Alerts
Following rules were updated:
/All Rules/ArcSight Foundation/Security Threat Monitoring/Host Monitoring/Chained Rule - Inhibit System Recovery
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email/Email Sent To Suspicious Address
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts to Suspicious Source
/All Rules/ArcSight Foundation/Threat Intelligence Platform/GTAP Connector Health/Track GTAP Connector Type
/All Rules/ArcSight Foundation/Threat Intelligence Platform/High Confidence Alerts/GTAP Plus High Confidence Alerts with Suspicious File Hash
/All Rules/ArcSight Foundation/Threat Intelligence Platform/Dangerous Browsing/Dangerous Browsing to a Suspicious URL
In the release version 4.0, following MITRE IDs were added or rules were added to existing MITRE IDs
T1552.006 T1553.005
Following new rules are added:
Following rules were updated:
Fields were expended from 15 to 37 in the following active lists:
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Addresses List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Domain List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Email List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious Hash List
/All Active Lists/ArcSight Foundation/Threat Intelligence Platform/Suspicious URL List
Following dashboards were added:
Following dashboards were updated:
Sample replay events
This zip file contains four files: two replay events, one arb package, and readme.
In order to trigger/test rules in the default content, you need to:
1) Make sure install 4.0 package before install the package in this zip file for testing rules in the Threat Intelligence Platform package
2) Enable rules which you want to test
ESM 7.2 and above
Threat Intelligence Platform package requires MIC for GTAP
Suggested for you are based on app category, product compatibility, popularity, rating and newness. Some apps may not show based on entitlements. Learn more about entitlements.
This release rebrands Galaxy Threat Acceleration Program to ArcSight Threat Acceleration Program (GTAP to ATAP) and exchanges all CyberRes references for ArcSight. Additionally, 4.2 adds new content.
This release rebrands Galaxy Threat Acceleration Program to ArcSight Threat Acceleration Program (GTAP to ATAP) and exchanges all CyberRes references for ArcSight. Additionally, 4.2 adds new content.
Replay events for the default content 4.2.
The release 4.1 contains 12 new rules in the Security Threat Monitoring package to detect more cyber security attacks for the windows system, and added 3 new rules in the Threat Intelligence Platform package with very high confidence, and an active channel to display the very high confidence alerts. It also updated 8 rules.
Added 3 new rules in the Threat Intelligence Platform package with very high confidence, and an active channel to display the very high confidence alerts. It also updated 8 rules.
Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox
