Modular Objective Templates v8.0.0

The following modular objective templates can be used as a basis for your own objectives.

The objective types may be altered via configuring your objective, and selecting 'Change Type' in the top right corner. This will display a list of Objective Types to select from.

	Log Type: ACF2Log Title Changes to Accounts Class: Account Administration This objective displays information relating to ACF2 account modifications. ACF2 logs can be collected from an IBM MVS mainframe, and analysed using the Snare Central. The logs from the ACF2 mainframe are collected via FTP or SCP file transfer into the /data/SnareCollect/ACF2Log/ directory on the Snare Central.
	Log Type: ACF2Log Title: Changes to Flags Class: Account Administration For each CHANGE, DELETE or INSERT, this objective displays the details of the ACF2 changes on an MVS host.
	Log Type: ACF2Log Title: Access to the INFOSTORE database Class: Object Access The Infostore database (ACF60STO) is a sensitive repository of ACF2 information. This objective displays events relating to user access to the INFOSTORE database.
	Log Type: ACF2Log Title: ACF2 Rule Changes Class: Rule Changes This objective displays events relating to changes to Rules. The ability to change ACF2 rules on MVS systems indicates privileged access. This objective is able to monitor anyone that has been modifying these rules. The changing of ACF2 (on those MVS systems that use ACF2) should be carefully monitored to ensure only authorized users are undertaking authorized activity. This objective is able to maintain a view of actions undertaken in this security management activity.
	Log Type: ACF2Log Title: Access to the ACF2 Resources Class: Object Access This objective monitors access to MVS resources that are considered to be sensitive. Use the RESOURCE field to narrow your search criteria. A ReturnCode of VIOLATION, or *VIO, indicates a failed attempt to access the resource
	Log Type: ACF2Log Title: Accounts Created or Deleted Class: Account Administration This objective displays those ACF2 users on an MVS host which have been created or deleted.
	Log Type: ACF2Log Title: User Login Failures Class: User Login Failures This objective displays information relating to ACF2 user login failures.
	Log Type: AIXAudit Title: Executing a Process Class: Process Objectives This objective is used to monitor access to processes or applications that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to collect process events.
	Log Type: AIXAudit Title: Access to Sensitive Files Class: File Access Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on file accesses.
	Log Type: AIXAudit Title: User Login Class: User Login This objective is used to monitor user login actions on AIX servers. Note that FTP access is also counted as a 'login', but protocols such as SSH or VNC may not generate a login event. It is important that the 'Configure' section of the objective be used to define from which system(s) the login events are required, so that the user(s) of this objective are not flooded with too many login events. This will especially be the case in agencies that are of a significant size, and are collecting events from numerous AIX hosts.
	Log Type: AIXAudit Title: User access to the root account Class: User SU This objective is used to monitor access to the root account through the /bin/su utility.
	Log Type: AppleBSM Title: Failed access to a user account Class: User Privilege Escalation This objective is used to monitor failed access to a target account through the /bin/su utility.
	Log Type: AppleBSM Title: Executing a Process Class: Process Objectives This objective is used to monitor access to processes or applications that are considered to be sensitive. Note that to use this objective, the Snare agents must be configured to collect process events.
	Log Type: AppleBSM Title: Access to Sensitive Files Class: File Access Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare agents must be configured to report on file accesses.
	Log Type: AppleBSM Title: User Login Class: User Login This objective is used to monitor user login actions on Apple servers.
	Log Type: AppleBSM Title: Access to a target account Class: User Privilege Escalation This objective is used to monitor failed access to a target account through the /bin/su utility.
	Log Type: Browser Title: Messages from installed Snare Browser Agents Class: Browser Objectives Display configuration change and agent restart messages from Snare Browser agents.
	Log Type: Browser Title: Cookie Modifications Class: Browser Objectives Display cookie related events from Snare Browser agents.
	Log Type: Browser Title: Inappropriate material Class: Browser Objectives Display inappropriate material, accessed through a browser. WARNING INAPPROPRIATE CONTENT MAY BE DISPLAYED WITH THIS RANDOM SAMPLE. The images are linked directly to the target site. This means that your UserID will download the images through your proxy server (if enabled), which means you may appear in your own logs. Please also note that: 1) The originating user may not have deliberately accessed the content in question - it may have been a popup caused by a rogue web site, and 2) The image may no longer exist on the target site, in which case, you will receive a 'no image' placeholder within your web browser.
	Log Type: Browser Title: Access to Social Media and Related Sites Class: Browser Objectives Scan for access to social media and related sites. Please unlock this objective, and modify according to your requirements.
	Log Type: ConfigurationCheck Title: CISCO Pix/Router Configuration Checker Class: CISCO Configuration Checker Compare the current CISCO Pix or Router configuration to an authorised version. The objective will attempt to connect to the device using the 'telnet' protocol and display the current configuration. The current configuration will also be compared against an authorized 'Master' and changes will be highlighted. Two passwords in the "Configure" section (connect, and enable) are used to retrieve the configuration.
	Log Type: F5Violations Title: Violation Reports Class: Special Alerts Display events tagged as violations, from F5 ASM logs.
	Log Type: GauntletFirewallLog Title: Electronic Mail events Class: Electronic Mail The Gauntlet firewall generates events based on the email addresses that have been sent through the firewall. This objective allows the user to report on email information derived from the Gauntlet Firewall logs.
	Log Type: GenericSyslog Title: Monitor Session Growth Class: Session Information This objective can be used to monitor session volume notification events from custom applications that report the data to Snare Central. The output component included with this objective will trigger when the number of sessions grows by a predermined amount per source server. Notification events are assumed to be delivered in 1 minute intervals.
	Log Type: GenericSyslog Title: User Privilege Escalation through SU and Sudo Class: User Privilege Escalation This objective looks for SU or Sudo log entries in the Generic Syslog log source.
	Log Type: IPTablesFirewall Title: Accepted Local Network Connections Class: Local Network Connections Display non-dropped packets that have a source address of a non-routable IP block
	Log Type: IPTablesFirewall Title: Dropped Local Network Connections Class: Local Network Connections Display dropped packets that have a source address of a non-routable IP block
	Log Type: IPTablesFirewall Title: Accepted Non-Local Network Connections Class: Non-Local Network Connections Display non-dropped packets that have a source address of a routable IP block
	Log Type: IPTablesFirewall Title: Dropped Non-Local Network Connections Class: Non-Local Network Connections Display dropped packets that do not have a source address of a routable IP block
	Log Type: IrixSAT Title: General Administrative Tasks Class: Administrative Activity This objective reports on selected Irix audit events which indicate general administrative activity, such as sat_chroot, sat_mount, sat_clock_set, sat_hostname_set, sat_domainname_set, sat_hostid_set, sat_control, sat_bsdipc_snoop_ok, sat_bsdipc_snoop_fail, and sat_ae_audit.
	Log Type: IrixSAT Title: Successful Mount or Unmount Activity Class: Administrative Activity This objective monitors the mount or unmounting of disk volumes on Irix. This may be useful in those instances where it is required that access to specific volumes (such as floppy disks) be closely monitored.
	Log Type: IrixSAT Title: Executing a Process Class: Process Objectives This objective is used to monitor access to processes or applications that are considered to be sensitive.
	Log Type: IrixSAT Title: Access to Sensitive Files Class: File Access Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on file accesses.
	Log Type: IrixSAT Title: User Login Class: User Login This objective is used to monitor user login actions on Irix servers. Note that FTP access is also counted as a 'login', but protocols such as SSH or VNC may not generate a login event.
	Log Type: IrixSAT Title: User access to the root account Class: User SU This objective is used to monitor access to the root account through the /bin/su utility.
	Log Type: LinuxAudit Title: Account Management Class: Account Management Objectives This objective is used to monitor account management actions on Linux Servers. Note that the Linux audit subsystem will only generate events when an account or group, is modified using account management binaries. Situations where a root user manually modifies the /etc/passwd or /etc/group files, will not be detected by this objective.
	Log Type: LinuxAudit Title: Accessing a File Class: File Objectives This objective is used to monitor access to files that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to collect file events.
	Log Type: LinuxAudit Title: Group Account Management Class: Account Management Objectives This objective is used to monitor group account management actions on Linux Servers. Note that the Linux audit subsystem will only generate events when an account or group, is modified using account management binaries. Situations where a root user manually modifies the /etc/passwd or /etc/group files, will not be detected by this objective.
	Log Type: LinuxAudit Title: Executing a Process Class: Process Objectives This objective is used to monitor access to processes or applications that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to collect process events.
	Log Type: LinuxAudit Title: User Login Class: User Login This objective is used to monitor user login actions on Linux servers.
	Log Type: LinuxAudit Title: User Account Management Class: Account Management Objectives This objective is used to monitor user account management actions on Linux Servers. Note that the Linux audit subsystem will only generate events when an account or group, is modified using account management binaries. Situations where a root user manually modifies the /etc/passwd or /etc/group files will not be detected by this objective.
	Log Type: MSDNSServer Title: Microsoft DNS Server Logs. DNS Client IP Find Class: MSDNSServer This objective is used to retrieve DNS traffic from/to IP.
	Log Type: MSDNSServer Title: Microsoft DNS Server Logs. DNS over TCP Class: MSDNSServer This objective is used to monitor DNS over TCP suspicious usage.
	Log Type: MSDNSServer Title: Microsoft DNS Server Logs. DNS Server Failure Class: MSDNSServer This objective is used to monitor DNS Server Response Failure.
	Log Type: MSDNSServer Title: Microsoft DNS Server Logs. NXDOMAIN Class: MSDNSServer This objective is used to monitor Non Existent Domains DNS Queries Only.
	Log Type: NetScreenFirewall Title: IP Spoofing Notifications Class: Special Alerts Display IP spoofing notifications from Netscreen Firewalls.
	Log Type: NetScreenFirewall Title: Large ICMP Packet Notifications Class: Special Alerts Display Large ICMP Packet notifications from Netscreen Firewalls.
	Log Type: NetScreenFirewall Title: Port Scan Notifications Class: Special Alerts Display port scan notifications from Netscreen Firewalls.
	Log Type: NetworkMapper Title: Network Mapper Class: Network Mapping and Vulnerability Scan This objective allows you to scan your network for open services. New systems, or systems with unauthorized ports, will be highlighted for your attention. In addition, an optional network security scan can be conducted against any hosts that are found. The report may be displayed in tabular format, which is useful for the analysis of many hosts on any given network. In both "iconized" and "tabular" formats, an authorized "port list" can be configured on a host-by-host basis. Future scans against the host in question will highlight any changes in port activation or deactivation. The network scanner can be configured to scan both TCP and/or UDP port ranges. Warning UDP scanning is very slow and should be used with care. This is because UDP will always have to wait for a timeout to determine if a port is closed. If this timeout is too short, then it will miss valid ports and not correctly report. This objective uses the free Open Source tool, NMAP. NMap is used to determine the open ports on one or more hosts. Further details are available from: http://www.insecure.org/
	Log Type: NortelVPNRouter Title: Configuration Changes Class: Configuration Changes This objective will watch for configuration changes to Nortel VPN Routers - such as the creation, destruction, or modification of particular configuration items.
	Log Type: NortelVPNRouter Title: Failed Logins Class: Authentication Events This objective will scan for failed attempts to access the VPN device by searching for events that include "Failed Login Attempt" or "failed to log in".
	Log Type: NortelVPNRouter Title: Successful Logins Class: Authentication Events This objective will scan for successful logins to the VPN device by searching for events that include "logged in from", "logged into group" or "login by using".
	Log Type: ObjectAccess Title: Access to the ACF2 Resources Class: Object Access This objective monitors access to ACF2 Objects that are considered to be sensitive. Use the OBJECT field to narrow your search criteria.
	Log Type: ObjectAccess Title: Access to Lotus Notes Resources Class: Object Access This objective monitors access to Lotus Notes Database Resources. Use the OBJECT field to narrow your search criteria.
	Log Type: PANFirewall Title: Threat Reports Class: Special Alerts Display threat-related events from Palo Alto Network Firewalls.
	Log Type: PIXLog Title: User Authentication events Class: Authentication Display user authentication events
	Log Type: RACFLog Title: Access to RACF Resources Class: Object Access This objective monitors access to RACF resources that are considered to be sensitive. A ReturnCode of 0 implies a failed attempt to access the resource. Use the RESOURCE field to narrow your search criteria.
	Log Type: RACFLog Title: User Logins Class: User Login This objective displays information relating to RACF user logins.
	Log Type: SOCKSLog Title: Failed Authentication Class: User Authentication This objective looks for failed authentication events from a SOCKS server.
	Log Type: SolarisBSM Title: Failed access to a user account Class: User Privilege Escalation This objective is used to monitor failed access to a target account through the /bin/su utility.
	Log Type: SolarisBSM Title: Executing a Process Class: Process Objectives This objective is used to monitor access to processes or applications that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to collect process events.
	Log Type: SolarisBSM Title: Access to Sensitive Files Class: File Access Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on file accesses.
	Log Type: SolarisBSM Title: User Login Class: User Login This objective is used to monitor user login actions on Solaris servers.
	Log Type: SolarisBSM Title: Access to a target account Class: User Privilege Escalation This objective is used to monitor access to a target account through the /bin/su utility.
	Log Type: SonicWall Title: Dropped Packets Class: Packet Logs Display events that have a category that indicates dropped packets
	Log Type: Tru64Audit Title: Access to Sensitive Files Class: File Access Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on file accesses.
	Log Type: Tru64Audit Title: User Login Class: User Login This objective is used to monitor user login actions on Tru64 servers.
	Log Type: Tru64Audit Title: User access to a target account Class: User Privilege Escalation This objective is used track access to a target account through the /bin/su utility.
	Log Type: UniversalLog Title: Reading Reports Class: Report Access This objective allows you to search for reports that have been read.
	Log Type: UniversalLog Title: Print Reports Class: Report Prints This objective allows you to search for reports that have been printed.
	Log Type: UniversalLog Title: Query Term Analysis Class: Search Analysis This objective allows you to monitor the search terms used in Universal Log data, based on a 'Query' event in the 'Message' field.
	Log Type: UniversalLog Title: User Login Class: User Login This objective allows you to monitor user logins reported in the Universal Log data.
	Log Type: UserGroupSnapshot Title: Account Expiry Class: Account Expiry This objective displays account expiry settings (in days) by system and/or domain. Please note that this objective requires Snare for Windows version 2.6.2 or later. For accounts retrieved from the Windows Active Directory interface, the objective reports the current maximum time since any non-expired user has changed their password, which should generally provide an approximation of probable server password expiry settings in most circumstances.
	Log Type: UserGroupSnapshot Title: Sensitive Groups Class: Sensitive Groups This objective takes snapshots of the applicable group memberships and compares them to a specified list to report on authorized and unauthorized group members. The Snare Central will regularly query the specified server(s) to determine the members of all groups. This is then used by these objectives to determine which users have been authorized to be members of this group, and which are not.
	Log Type: UserGroupSnapshot Title: Account Flags Class: Account Flags This objective displays those users who have settings configured on their account that are considered sensitive or important from a security viewpoint. These attributes are queried on a regular basis by connecting to specified Snare Agents. The updated information will be displayed in these reports, on a scheduled basis, as required by the users of these objectives.
	Log Type: WebLog Title: Inappropriate material accessed through a proxy server Class: Proxy Server Objectives Display inappropriate material, accessed through an organisational proxy server, by searching for a range of defined words, in the URLs that are logged by a proxy server. Warning INAPPROPRIATE CONTENT MAY BE DISPLAYED WITH THIS RANDOM SAMPLE. The images are linked directly to the target site. This means that your UserID will download the images through your proxy server (if enabled), which means you may appear in your own logs. Please also note that: The originating user may not have deliberately accessed the content in question - it may have been a popup caused by a rogue web site, and The image may no longer exist on the target site, in which case, you will receive a 'no image' placeholder within your web browser.
	Log Type: WebLog Title: Proxy Server Logs Class: Proxy Server Objectives Query Proxy Server Logs.
	Log Type: WebLog Title: Suspicious URL Access on your web servers Class: Web Server Objectives Display URLs that are generally associated with cross site scripting attacks.
	Log Type: WinApplication Title: Application Crash Class: Administrative Activity This objective is used to monitor crashed applications.
	Log Type: WinApplication Title: EMET Failures Class: Administrative Activity This objective is used to monitor error messages from Microsoft's Enhanced Mitigation Experience Toolkit.
	Log Type: WinApplication Title: NetIQ Administrative Activity Class: Administrative Activity This objective is used to monitor administrative activity using the NetIQ product.
	Log Type: WinApplication Title: NetIQ Group Administrative Activity Class: Administrative Activity This objective is used to monitor group administrative activity using the NetIQ product.
	Log Type: WinApplication Title: NetIQ User Administrative Activity Class: Administrative Activity This objective is used to monitor user administrative activity using the NetIQ product.
	Log Type: Oracle Title: Oracle SYSTEM Usage Class: Oracle Server Display activity for users with SYSDBA and SYSOPER privileges.
	Log Type: Oracle Title: Oracle Password Change Audit Class: Oracle Server Display Password Change Events for all users.
	Log Type: Oracle Title: Oracle Security Audit Class: Oracle Server Display Potentially Dangerous SQL Events.
	Log Type: Oracle Title: Oracle Audit Events Class: Oracle Server Display Generic Oracle Activity.
	Log Type: Oracle Title: Oracle User Session Audit Class: Oracle Server Display all user Activity for given DBUSER.
	Log Type: WinApplication Title: Windows File Protection Class: Administrative Activity The Windows File Protection service monitors critical system files and attempts to prevent unauthorized software from modifying or replacing these files. This objective is used to monitor WFP warning events.
	Log Type: WinSecurity Title: Account Creation and Deletion Class: Administrative Actions This objective displays Windows accounts (in specified domains) that have been recently created or deleted.
	Log Type: WinSecurity Title: Group Creation and Deletion Class: Administrative Actions This objective displays Windows groups that have been recently created or deleted.
	Log Type: WinSecurity Title: Failed User Logins Class: User Login This objective is used to monitor failed user login actions on Windows servers.
	Log Type: WinSecurity Title: Windows File Access Class: Windows File Objectives Monitor access to file and directories that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on file accesses.
	Log Type: WinSecurity Title: Group Modifications Class: Administrative Actions This objective shows modifications to specified sensitive Windows groups.
	Log Type: WinSecurity Title: Group Member Changes Class: Administrative Actions This objective shows changes to the members of sensitive Windows Groups.
	Log Type: WinSecurity Title: User Interactive Logins and Logoffs Class: User Login This objective is used to monitor interactive account login and logoff events. This includes workstation locked/unlocked events and screen saver invoked/dismissed events.
	Log Type: WinSecurity Title: Local Account added to Administrators Class: Administrative Actions This objective displays Windows local accounts that have been added to the Local Administrators Group.
	Log Type: WinSecurity Title: Audit Log Cleared Class: Administrative Actions This objective checks to see if the Windows event logs were cleared. Note that the Snare Agent must be configured to collect these events. The clearing of an event log may indicate that a user is attempting to cover their tracks.
	Log Type: WinSecurity Title: Type 3 and Type 10 Network logins Class: User Login This objective displays Windows Type 3 host to host network logins and Type 10 RDP network logins.
	Log Type: WinSecurity Title: Changes to the Audit Policy Class: Administrative Actions Although the Snare for Windows agent is able to configure the hosts audit sub-system, this objective keeps an eye on events which indicate an attempt to change the underlying audit configuration. Changes to the underlying audit subsystem may indicate a user that is attempting to hide their "tracks", or attempting to obscure their (potentially) unauthorized activity.
	Log Type: WinSecurity Title: New Process Created Class: Process Objectives Monitor when new processes are created.
	Log Type: WinSecurity Title: Oracle Start Stop Log Class: Oracle Server Display Oracle startup and shutdown events.
	Log Type: WinSecurity Title: Windows Object Permission Changes Class: Windows File Objectives Monitor permission changes to a file or directory that is considered sensitive. Note that to use this objective, the Snare agents must be configured to report on event 4670.
	Log Type: WinSecurity Title: Privilege Escalation Class: Administrative Actions This objective displays Windows user rights changes to allow monitoring for escalation of user privileges.
	Log Type: WinSecurity Title: Windows Process Access Class: Process Objectives Monitor access to applications that are considered to be sensitive. Note that to use this objective, the Snare Agents must be configured to report on process execution.
	Log Type: WinSecurity Title: Scheduled task was created Class: Administrative Actions This objective displays when a new scheduled task has been created.
	Log Type: WinSecurity Title: Service was installed Class: Administrative Actions This objective displays when a service is installed on the system.
	Log Type: WinSecurity Title: Startup Run Tasks Alert Class: Administrative Actions This objective displays when the Run and RunOnce registry keys have been modified.
	Log Type: WinSecurity Title: User Modifications Class: Administrative Actions This objective shows modifications to specified sensitive Windows users.
	Log Type: WinSecurity Title: User Login Class: User Login This objective is used to monitor user login actions on Windows servers.
	Log Type: WinSecurity Title: Account Creation and Deletion on Windows and ACF2 Class: Administrative Actions This objective displays any differences between Windows and ACF2 account creation details. In particular, the objective will display: 1) Account Creation and Removal for ACF2, that does not have a corresponding create/remove for Windows, and 2) Display Account Creation and Removal for Windows, that does not have a corresponding create/remove for ACF2.
	Log Type: WinSystem Title: Windows 2008R2 Non-Security Audit Log Cleared Class: Administrative Actions This objective checks to see if the Windows Application, System or another non-security event log was cleared. Note that the Snare agent must be configured to collect these events.
	Log Type: WinSystem Title: Audit Log Corrupt Class: Administrative Actions Display Windows machines that have reported a corrupt event log, during the reporting period. Corrupt event log reporting is only available in Snare for Windows version 3.0.0 and above.

Snare Central v8 Documentation

Modular Objective Templates v8.0.0

Analytics

Related content