VPN Monitoring Security Use Case Guide version 1.1

HPE Security ArcSight ESM: VPN
Monitoring
Software Version: 1.1
Security Use Case Guide
April 3, 2017

Legal Notices
Warranty
The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
The network information used in the examples in this document (including IP addresses and hostnames) is for illustration
purposes only.
HPE Security ArcSight products are highly flexible and function as you configure them. The accessibility, integrity, and
confidentiality of your data is your responsibility. Implement a comprehensive security strategy and follow good security
practices.
This document is confidential.
Restricted Rights Legend
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use or copying.
Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical
Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
Copyright Notice
© Copyright 2016 Hewlett Packard Enterprise Development, LP
Follow this link to see a complete statement of copyrights and acknowledgements:
https://www.protect724.hpe.com/docs/DOC-13026
Support
Phone Alistof phone numbers is available on the HPE Security ArcSightTechnical Support
Page: https://softwaresupport.hpe.com/documents/10180/14684/esp-support-
contact-list
Support Web Site https://softwaresupport.hpe.com
Protect 724 Community https://www.protect724.hpe.com
Contact Information
HPE ESM: VPN Monitoring 1.1 Page 2 of 19

Contents
Chapter 1: Overview 4
Chapter 2: Installation 6
Importing and Installing a Package 7
Assigning User Permissions 8
Chapter 3: Configuration 9
Chapter 4: Using the VPN Monitoring Use Case 11
Monitoring VPN Login Activity in a Dashboard 12
Investigating VPN Events in an Active Channel 13
Running Reports 15
VPN Monitoring Rules 18
Send Documentation Feedback 19

Chapter 1: Overview
A Virtual Private Network (VPN) is the standard for extending your internal network to properly
authorized users outside the normal network perimeter. There are potential security risks associated
with any VPN implementation.
The VPN Monitoring use case helps you monitor your VPN devices using statistical information about
access to critical network assets. You can use this use case for sophisticated data analysis and
correlation to detect and analyze security threats, such as network infiltration and data leakage.
Use the resources in this use case for incident investigation as well as routine monitoring to detect
suspicious, abnormal or malicious activity:
l A dashboard is provided to show an overview of VPN login activity in real time. You can view the top
ten users with the most login activity and the most failed logins, as well as all login results (attempted,
successful, and failed) and the last ten failed and the last ten successful login events.
l An active channel is provided so that you can investigate all VPN events received within the last ten
minutes.
l Several reports provide charts and tables showing historical information about the top VPN events,
event sources, event destinations, and the top users by average session length. Other reports show
the number of VPN connections for each user, and VPN connection attempts and failures.
You can access the VPN Monitoring use case from the Use Cases tab of the ArcSight Console
Navigator panel. The Monitor section of the use case lists the dashboard, active channel, and reports
used to monitor traffic and investigate events. The Library section of the use case lists all supporting
resources that help compile information in the dashboard, active channel, and reports.
The use case also provides a configuration wizard that guides you through required configuration.

The VPN Monitoring use case is shown below.
This document describes how to install, configure, and use the VPN Monitoring use case and is
designed for security professionals who have a basic understanding of ArcSight ESM and are familiar
with the ArcSight Console. For detailed information about using ArcSightESM, see the ArcSight ESM
help system from the ArcSight Console Help menu. Find PDFs of all ArcSight documentation on
Protect 724.
Chapter 1: Overview

Chapter 2: Installation
To install the VPN Monitoring use case, perform the following tasks in the following sequence:
1. Download the VPN Monitoring use case zip file into the ArcSight Console system where you plan
to install the use case, then extract the zip file.
2. Log into the ArcSight Console as administrator.
Note: During the package installation process, do not use the same administrator account to
start another Console or Command Center session simultaneously. This login is locked until the
package installation is completed.
3. Verify if you have a previous version of the use case package you want to install. If so, uninstall and
delete this previous version:
a. On the Packages tab of the Navigator panel, right-click the package and select Uninstall
Package. The package icon is gray when it is uninstalled.
b. Right-click the package and select Delete Package.
4. On the Packages tab, verify if Downloads Groups is already installed. If you see packages in /All
Packages/Downloads/Downloads Groups, then ignore this step.
If the Downloads Groups package is not present, import and install the Downloads_Groups_1.0.arb
package. See "Importing and Installing a Package" on the next page for details.
5. Import and install the VPN Monitoring use case package. See "Importing and Installing a Package"
on the next page for details.
6. Assign user permissions to the VPN Monitoring resources. See "Assigning User Permissions" on
page 8 for details.

Importing and Installing a Package
Follow the steps below to import and install the package(s). This assumes you have downloaded the zip
file and extracted the contents into the ArcSight Console system.
l If the ArcSight Console does not have the Downloads Groups package in /All
Packages/Downloads/Downloads Groups, import and install the package first. Then repeat the
steps to import and install the VPN Monitoring use case package.
Note: The Downloads Groups package contains the groups used by the resources in the security
use case; you must import and install this package first.
l If the Downloads Groups package is already installed, follow the steps to import and install the VPN
Monitoring use case package only.
To import and install a package:
1. Log into the ArcSight Console as administrator. In the Navigator panel, click the Packages tab.
2. Click Import.
3. In the Open dialog, browse and select the package file (*.arb) you want to import, then click Open.
The Importing Packages dialog shows how the package import is being verified for any resource
conflicts.
4. In the Packages for Installation dialog, make sure that the check box is selected next to the name of
the package you want to install and click Next.
The Progress tab shows how the installation is progressing. When the installation is complete, the
Results tab displays the summary report.
5. In the Installing Packages dialog, click OK. In the Importing Packages dialog, click OK.
6. On the Packages tab of the Navigator panel, expand the package group in /All
Packages/Downloads/ to verify that the package group is populated and that installation is
successful.

Assigning User Permissions
By default, users in the Administrators and Default User Groups/Analyzer
Administrators user groups can view and edit the resources. Users in the Default User Groups
(and any custom user group under this group) can only view VPN Monitoring resources. Depending on
how you set up user access controls within your organization, you might need to adjust those controls
to make sure the resources are accessible to the right users.
Note: By default, the Default User Groups/Analyzer Administrators user group does
not have edit permissions for archived reports in the Downloads group.
The following procedure assumes that you have logged into the ArcSight Console as administrator, and
that you have set up the required user groups with the right users.
To assign user permissions:
1. In the Navigator panel, open the Resources tab.
2. For each of the resource types provided in the use case, navigate to Downloads/VPN
Monitoring.
3. Right-click the VPN Monitoring group and select Edit Access Control to open the ACL editor in
the Inspect/Edit panel.
4. Select the user groups for which you want to grant permissions and click OK.

Chapter 3: Configuration
Before configuring the use case, make sure that you have populated your ESM network model. A
network model keeps track of the network nodes participating in the event traffic. For information
about populating the network model, refer to the ArcSight Console User’s Guide.
The VPN Monitoring use case requires the following configuration for your environment:
l Install the appropriate ArcSight SmartConnectors to receive relevant events. For example, to receive
relevant events from Cisco VPN devices, install the SmartConnector for Cisco VPN Syslog.
l Manually categorize all internal assets (assets inside the company network), or the zones to which the
assets belong, with the Protected asset category (located in /All Asset Categories/Site
Asset Categories/Address Spaces/Protected). Assets that are not categorized as internal
to the network are considered to be external. Make sure that you also categorize assets that have
public addresses but are controlled by the organization (such as Web servers) as Protected.
A configuration wizard is provided to guide you through some of the required configuration. Follow the
procedure below.
Note: You must categorize assets internal to the network manually; the procedure is not part of the
configuration wizard. For information about categorizing assets, see the ArcSight Console User's
Guide.
To configure the VPN Monitoring use case:
1. In the Navigator panel, click the Use Cases tab.
2. Browse for the VPN Monitoring use case located in /All Use Cases/Downloads/VPN
Monitoring.
3. Open the VPN Monitoring use case : either double-click the use case or right-click the use case and
select Open Use Case.
The VPN Monitoring use case lists all the resources used for monitoring VPN activity.

4. Click the Configure button to open the configuration wizard.
5. Click Next to follow the configuration steps.
After you configure the VPN Monitoring use case, you are ready to monitor your VPN devices. See
"Using the VPN Monitoring Use Case" on page 11.
Chapter 3: Configuration

Chapter 4: Using the VPN Monitoring Use
Case
The VPN Monitoring use case is located on the Use Cases tab in the Navigator panel under /All Use
Cases/Downloads/VPN Monitoring.
To open the VPN Monitoring use case in the Viewer panel, either double-click the use case or right-click
the use case and select Open Use Case.
The Monitor section of the VPN Monitoring use case provides resources to help you monitor and
investigate VPN-related activity:
l Use the dashboard to monitor all VPN login activity in real time. See "Monitoring VPN Login Activity
in a Dashboard" on the next page.
l Use the active channel to investigate all VPN events. See "Investigating VPN Events in an Active
Channel" on page 13.
l Run reports that show the top VPN events, event sources, event destinations, and users by average
session length. The reports also show the number of VPN connections for each user, and
VPN connection attempts and failures. See "Running Reports" on page 15.
The Library section of the VPN Monitoring use case lists all supporting resources that help compile
information in the dashboard, active channel, and reports and includes rules that generate correlated
events when triggered. The rules are described in "VPN Monitoring Rules" on page 18.

Monitoring VPN Login Activity in a Dashboard
The VPN Monitoring use case provides a dashboard to help you monitor VPN login activity in real time.
Use the information in the dashboard to look for patterns of use or misuse, or any unusual activity that
might indicate potential security concerns.
To open the dashboard, click the link for the VPN Login Overview dashboard in the VPN Monitoring
use case.
The dashboard opens in the Viewer panel of the ArcSight Console and displays these data monitors:
l Top Users by Login Activity displays a pie chart showing the top ten users with the most VPN
login activity within the last 60 minutes. Investigate any unusual or excessive login activity by a user
as this might indicate a potential security concern. For example, an excessive number of logins by a
particular user might indicate that a brute force attack is in progress.
l Login Results displays a pie chart showing the number of VPN login attempts, successes, and
failures within the last 60 minutes. Examine this data monitor for unusual patterns that might
indicate that an attack is being attempted.
l Top 10 Users With Failed Logins shows the ten users with the highest number of failed VPN logins
within the last 60 minutes. This information is very useful to determine if somebody is trying to
compromise your network through your VPN device. Investigate repeated or abnormal failed
connections as they might indicate potential attacks.
l Last 10 Successful Login Events shows information about the last ten successful logins to a
VPN device. You can see the VPN user name, source, destination, and zone information. Watch this
activity for any unusual behavior.
l Last 10 Failed Login Events shows details about the last ten VPN logins that failed. You can see
the VPN user name, the source, destination, and zone information. Investigate multiple failed
VPN logins from the same user as this might indicate malicious activity.
Chapter 4: Using the VPN Monitoring Use Case

An example VPN Login Overview dashboard is shown below.
Right-click on an item in a data monitor and select Investigate > Create Channel to open an active
channel and investigate events further. For example, right-click on a user name in the Top Users by
Login Activity data monitor and select Investigate > Create Channel to open an active channel and
investigate the user to obtain details, such as the source IP address and the destination IP address. In
the active channel, you can also:
l Create an inline filter to focus on events of interest; for example, you can filter on a specific user name
or source address. For detailed information about using inline filters, see the ArcSight Console User's
Guide.
l Double-click on an event in the active channel to open the event inspector and see details about the
event.
Investigating VPN Events in an Active Channel
The VPN Monitoring active channel shows all VPN events received within the last ten minutes.
Observing and understanding VPN events is essential to the security of your environment and can help
you prevent malicious activity and mitigate significant security risks.
To open the active channel, click the VPN Events link in the VPN Monitoring use case.

The VPN Events active channel opens in the Viewer panel. An example VPN Events active channel is
shown below.
Examine these events to spot any unusual patterns involving VPN user logins, and start and terminate
VPN sessions. Be sure to investigate events with an ESM priority higher than 7 as this might represent a
potential risk to your network. The priority of an event is listed in the Priority column on the far right of
the active channel display. You might have to scroll to see the Priority column.
Right-click an item (such as IP address) and select Show Event Details to see detailed information
about the event. You can also create an inline filter to display events from a specific item. See the
ArcSight Console User's Guide's topic on using active channels for information about menu options and
inline filters.
Note: The events displayed in an active channel do not refresh automatically at ten-minute

intervals. To refresh the view, click the Stop and Replay channel controls in the toolbar.
Depending on your environment, ESM load, and specific investigation needs, you can configure an
active channel to use continuous, automatic channel refresh: Right-click the link for the active
channel in the use case and select Edit Active Channel. From the Time Parameters drop-down on
the Attributes tab of the Inspect/Edit panel, select Continuously evaluate.
Note: In a high EPS environment, you might see performance issues if you scroll down to try and
view all the events in the active channel.
Running Reports
The VPN Monitoring use case provides several reports that you can run to obtain a historical view of
your VPN activity graphically in a table or a chart. You can provide these reports to the stakeholders in
your company. The reports use VPN device activity information provided by the VPN Connections
trend, which runs every day using the VPN Connections - Trend Base query.
By default, the reports use data from the previous day. You can change the start and end time of the
report for longer- or shorter-term analysis when you run the report.
To run a report:
1. Click the link for the report in the VPN Monitoring use case.
2. In the Report Parameters dialog, set the parameters, then click OK. For example, you can change
the report format from HTML (the default) to pdf, csv, xls, or rtf, change the page size, and update
the report start and end time.

3. For formats other than HTML, either open the report or save the report to your computer when
prompted.
The VPN Monitoring use case provides the following reports:
l Users by Connection Count shows information about the number of VPN connections for each
user. A summary of the users with the most connections is provided. Details of the connections for
each user are also provided, including the number of connections and the systems accessed.
l Top Users by Average Session Length shows duration information about VPN sessions for each
user. A summary of the top VPN connection duration by user is provided. Details of the connection
duration for each user are also provided, including minimum, average, maximum, and total
connection minutes. Also provided are details about sessions that are currently active at the time the
report is run.
l Top VPN Event Destinations provides a table showing the IP address, hostname and zone for the
top destinations in VPN events, sorted by the number of connections per destination.
l VPN Connection Attempts provides a table showing event information where VPN access did not
result in failure.
l Top VPN Event Sources provides a table showing the IP address, hostname, and zone for the top
sources in VPN events, sorted by the number of connections per source.
l Top VPN Events provides a table showing the top VPN events (modification events are not
included). The table provides the event name, and the source and destination IP address and zone.
l VPN Connection Failures provides a table showing information about failed VPN connections. The
information includes the VPN user name, source and destination IP address and zone, the
VPN device IP address and zone, and the number of failed connections.

An example chart from the Top Users by Average Session Length report is shown below.

VPN Monitoring Rules
The VPN Monitoring use case provides two rules, described below. The rules are deployed in the Real-
time Rules group on the Resources tab of the Navigator panel (/All Rules/Real-time
Rules/Downloads/Network Monitoring/VPN Monitoring) and enabled by default. The rules
trigger when events match one or more set of conditions, at which point a correlation event is
generated. A correlation event is displayed in an active channel with the flash icon . Correlation
events are fed back into the event life cycle at the ArcSight Manager and are evaluated by both the
ArcSight Manager and by the correlation processes. For more information about rule triggering and
correlation events, see the ArcSight Console User's Guide.
l User VPN Session Started
This rule triggers when a VPN user session start event is detected. The rule then creates a new VPN
session in the User VPN Sessions and VPN Session by Source IP session lists. This rule supports
Cisco VPN products, the Nokia's Security Platform product, and Nortel's VPN product.
l User VPN Session Stopped
This rule triggers when a VPN user session terminate event is detected. The rule then terminates the
VPN session in the User VPN Sessions and VPN Session by Source IP session lists.This rule supports
Cisco VPN products, the Nokia's Security Platform product, and Nortel's VPN product.

Send Documentation Feedback
If you have comments about this document, you can contact the documentation team by email. If an
email client is configured on this system, click the link above and an email window opens with the
following information in the subject line:
Feedback on Security Use Case Guide (ESM: VPN Monitoring 1.1)
Just add your feedback to the email and click send.
If no email client is available, copy the information above to a new message in a web mail client, and send
your feedback to arc-doc@hpe.com.
We appreciate your feedback!

VPN Monitoring Security Use Case Guide version 1.1

More Related Content

What's hot (20)

Similar to VPN Monitoring Security Use Case Guide version 1.1 (20)

More from Protect724manoj (20)

Recently uploaded (20)

VPN Monitoring Security Use Case Guide version 1.1