GP.Facilities Monitoring - Revision history

Daniel Jumelet at 21:11, 17 June 2015

2015-06-17T21:11:15Z

← Older revision		Revision as of 21:11, 17 June 2015
Line 20:		Line 20:
	{{Pattern Graphic		{{Pattern Graphic
	\|graphic=GP.Facilities Monitoring.png		\|graphic=GP.Facilities Monitoring.png
			\|source=GP.
	\|size=650px		\|size=650px
	\|title=Generic Pattern Facilities Monitoring		\|title=Generic Pattern Facilities Monitoring
Line 28:		Line 29:
	\|function=GF.Rules Engine		\|function=GF.Rules Engine
	\|choice=Must		\|choice=Must
	\|reason=This function represents the intelligence that drives the services provided by the Pattern. Active collection of information, responses caused by incoming information, and ways and means to alert and/or report are all directed by (implicit or explicit) rules.		\|reason=This function represents the intelligence that drives the services provided by the Pattern. All data collected by the facility should be normalized, and must be investigated for patterns that signal noteworthy security or operational events. Active collection of information, responses caused by incoming information, and ways and means to alert and/or report are all directed by (implicit or explicit) rules.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
	\|function=GF.Data Scanning		\|function=GF.Data Scanning
	\|choice=~~Must~~		\|choice=May
	\|reason=~~All~~ data ~~collected by the facility should be normalized,~~ and ~~must be investigated for~~ patterns ~~that signal noteworthy security or operational events~~.		\|reason=This function is used to collect data from in transit data traffic (network flows and traffic patterns).
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
Line 39:		Line 40:
	\|choice=May		\|choice=May
	\|reason=This function is often included, as it enables Facilities Monitoring to monitor (operational or security) events that have occurred in the monitored systems.		\|reason=This function is often included, as it enables Facilities Monitoring to monitor (operational or security) events that have occurred in the monitored systems.
	}}
	~~{{Generic Pattern Composition Row~~
	~~\|function=GF.Filtering~~
	~~\|choice=May~~
	\|reason=This function enables Facilities Monitoring to monitor data streams within attached systems for patterns that signal (operational or security) threats to the monitored system and/or to other IT facilities. Thus, it mainly serves to model Intrusion Detection and Intrusion Prevention.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
Line 73:		Line 69:
	\|function=GF.Alerting		\|function=GF.Alerting
	\|choice=May		\|choice=May
	\|reason=This function delivers warning messages and/or signals that are triggered by the processing of all manners of (combinations of) detected facility events.		\|reason=This function delivers warning messages and/or signals that are triggered by the processing of all manners of (combinations of) detected facility events.
	}}		}}
	{{Generic Pattern Composition Row		{{Generic Pattern Composition Row
Line 82:		Line 78:
	* The composition of reports, as well as scheduled creation and delivery of them;		* The composition of reports, as well as scheduled creation and delivery of them;
	* The addresses and methods used to deliver alerts.		* The addresses and methods used to deliver alerts.
	Care must be taken to limit access to this function to authorized systems and users.		Care must be taken to limit access to this function to authorized systems and users.
	}}		}}
	{{Table Ending}}		{{Table Ending}}

Jan Schoonderbeek: slight text update

2013-08-14T14:52:38Z

slight text update

← Older revision		Revision as of 14:52, 14 August 2013
Line 7:		Line 7:
	\|summary=This Pattern helps Operations and Security personnel to monitor other facilities for noteworthy events.		\|summary=This Pattern helps Operations and Security personnel to monitor other facilities for noteworthy events.
	}}		}}
	~~This~~ Pattern ~~helps Operations and Security personnel to~~ monitor other facilities for noteworthy events. ~~It can~~ trigger reactive management actions, but it can also trigger events pro-actively if patterns of suspect behaviour or suspect state are supplied to the Rules Engine.		Realizations of this Pattern can be used monitor other facilities for noteworthy events. This kind of facility is often used to help Operations and Security personnel in their functions.

			The Pattern has functionality to trigger reactive management actions, but it can also trigger events pro-actively if patterns of suspect behaviour or suspect state are supplied to the Rules Engine. Therefore, this Pattern covers many use cases, among others:
			* Centralized log services, that allow (automated or manual) inspection of system event logs.
			* Central system monitoring services provide status information to their users, be they infrastructure administrators and/or service managers;
			* Security Incident and Event Monitoring (SIEM) systems, that can alert when a security incident occurs, and report on the security state of the connected facilities.
			* Intrusion Detection Systems (IDS), that monitor network or system activities for suspect or malicious activities or policy violations. To this end, the Filtering function of the Pattern is implemented in each facility that's being guarded, to scan the streaming data in those facilities. It is the job of the Rules Engine to match the normalized data with patterns that are identified as suspect or malicious.
			* Intrusion Prevention Systems (IPS), that work like IDS systems, but are also capable of shutting down the data streams and/or other activities in the guarded facilities if a suspicious activity or policy violation is detected. Note that in this case the Filtering function does not only provide the Pattern with the information needed to determine intrusion; it also directly interacts with the guarded facility. If an IPS takes more elaborate actions, then you may have to augment this Pattern with matching Generic Functions.
	{{Pattern Realizes		{{Pattern Realizes
	\|service=GS.Facilities Monitoring		\|service=GS.Facilities Monitoring
Line 13:		Line 20:
	{{Pattern Graphic		{{Pattern Graphic
	\|graphic=GP.Facilities Monitoring.png		\|graphic=GP.Facilities Monitoring.png
	\|size=~~600px~~		\|size=650px
	\|title=Generic Pattern Facilities Monitoring		\|title=Generic Pattern Facilities Monitoring
	\|kind=Generic		\|kind=Generic

Jan Schoonderbeek: Pattern created

2013-08-14T14:24:29Z

Pattern created

@@ Line 7: / Line 7: @@
 |summary=This Pattern helps Operations and Security personnel to monitor other facilities for noteworthy events.
 }}
-forthcoming
+This Pattern helps Operations and Security personnel to monitor other facilities for noteworthy events. It can trigger reactive management actions, but it can also trigger events pro-actively if patterns of suspect behaviour or suspect state are supplied to the Rules Engine.
 {{Pattern Graphic
 |graphic=GP.Facilities Monitoring.png
-|size=500px
+|size=600px
 |title=Generic Pattern Facilities Monitoring
 |kind=Generic
@@ Line 54: / Line 57: @@
 |choice=May
 |reason=Scheduling can serve to run monitoring jobs, such as configuration retrieval, on regular or predetermined times
 }}
 {{Table Ending}}

Jan Schoonderbeek: intermediate save; added pic and texts

2013-08-14T13:08:56Z

intermediate save; added pic and texts

@@ Line 9: / Line 9: @@
 forthcoming
 {{Pattern Graphic
-|graphic=No graphic yet.png
+|graphic=GP.Facilities Monitoring.png
-|source=GP.
+|size=500px
-|size=400px
+|title=Generic Pattern Facilities Monitoring
 |kind=Generic
 }}
@@ Line 24: / Line 24: @@
 |choice=Must
 |reason=All data collected by the facility should be normalized, and must be investigated for patterns that signal noteworthy security or operational events.
 }}
 {{Table Ending}}

Jan Schoonderbeek: Created page with "{{Maturity|3}} {{Pageheaderbox4GP |name=Facilities Monitoring |sector=Operations |version=0.4 |owner=J.A.H. Schoonderbeek |summary=This Pattern helps Operations and Security p..."

2013-08-13T12:19:23Z

Created page with "{{Maturity|3}} {{Pageheaderbox4GP |name=Facilities Monitoring |sector=Operations |version=0.4 |owner=J.A.H. Schoonderbeek |summary=This Pattern helps Operations and Security p..."

New page

{{Maturity|3}}
{{Pageheaderbox4GP
|name=Facilities Monitoring
|sector=Operations
|version=0.4
|owner=J.A.H. Schoonderbeek
|summary=This Pattern helps Operations and Security personnel to monitor other facilities for noteworthy events.
}}
forthcoming
{{Pattern Graphic
|graphic=No graphic yet.png
|source=GP.
|size=400px
|kind=Generic
}}
{{Generic Pattern Composition}}
{{Generic Pattern Composition Row
|function=GF.Rules Engine
|choice=Must
|reason=This function represents the intelligence that drives the services provided by the Pattern. Active collection of information, responses caused by incoming information, and ways and means to alert and/or report are all directed by (implicit or explicit) rules.
}}
{{Generic Pattern Composition Row
|function=GF.Data Scanning
|choice=Must
|reason=All data collected by the facility should be normalized, and must be investigated for patterns that signal noteworthy security or operational events.
}}
{{Table Ending}}
{{Pattern Adjacent Services}}
{{Generic Pattern Adjacent Service Row
|service=GS.Data Management
|choice=Must
|reason=A Facilities Monitoring Pattern is likely to require some sort of structured data store to keep records of the data and events it has collected, reports generated et cetera.
}}
{{Generic Pattern Adjacent Service Row
|service=GS.Authentication+Authorization
|choice=May
|reason=Access to the services provided by the Facilities Monitoring Pattern is likely to be limited to authorized personnel; furthermore, the Facilities Monitoring system itself may require permissions to be able to collect data from the facilities that it's monitoring
}}
{{Table Ending}}
{{Text Footer GP}}