ESM 7 Distributed Correlation Paul MacGyver Carman Global Technical Security Sales Engineer #MicroFocusCyberSummit
Confidential information This is a rolling (up to three year) Roadmap and is subject to change without notice Confidential information. This Roadmap contains Confidential Information of Micro Focus and/or its affiliates (“Micro Focus”), and is subject to change without notice. If you have a valid Confidential Disclosure Agreement (“CDA”) with a Micro Focus entity, use of the Roadmap is subject to that CDA and allowed solely for the purpose of evaluating purchase decisions from Micro Focus. If not, it is subject to the following terms. For 3 years after disclosure, You may use the Roadmap solely for the purpose of evaluating purchase decisions from Micro Focus. You must use a reasonable standard of care to prevent disclosure. You will not disclose the contents of the Roadmap to any third party with Micro Focus’ prior written approval unless it first becomes publically known or is rightfully received by you from a third party without duty of confidentiality. 2
Agenda Why Distributed Correlation? Distributed Correlation Architecture Components and Relationship What gets processed where? Deployment and Sizing Examples Tips and Requirements Monitoring the ESM Cluster Next Steps 3
Why distributed correlation? Massively scales up to 100,000 Centralized Alerts correlated events per second per cluster and Content building Easily add nodes to scale out No more multi-tier configurations needed to scale out Clustered correlation No more forwarding connectors required between layers Split data stream to parallel processes Write more content , support across multiple nodes in a cluster heavier content HPE Confidential, under NDA use only
Architecture
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB Persistor CORRE DB Legend UI Interaction Data Exchange Repo Information Exchange Event Intake and Persistence Isolate persistence 6
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB Persistor CORRE DB Legend UI Interaction Correlators Data Exchange Correlators Repo Information Exchange Event Intake and Persistence Correlators: filter evaluation 7
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB Persistor CORRE DB Legend UI Interaction Correlators Data Exchange Correlators Repo Information Exchange Aggregators Event Intake Aggregators and Persistence Aggregators: grouping 8
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB Persistor M e CORRE DB s B Legend s u a s UI Interaction g Correlators Data Exchange e Correlators Repo Information Exchange Aggregators Event Intake Aggregators and Persistence Message Bus: events, data 9
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB D Persistor i M s e t C CORRE DB s B a r Legend s u i c a s h b UI Interaction g u e Correlators Data Exchange e t Correlators e Repo Information d Exchange Aggregators Event Intake Aggregators and Persistence Distributed Cache: lists, resources 10
The ESM 7 Distributed Correlation Architecture Console ACC Connectors / EB D Persistor i M s e t C CORRE DB s B a r Legend s u i c Repository a s h b UI Interaction g u e Correlators Data Exchange e t Correlators e Repo Information d Exchange Aggregators Event Intake Aggregators and Persistence Repository: global settings 11
Event Flow … In a Nutshell Correlation, Audit Correlation, Audit Audit Data Persisted Monitor Connectors, & Enriched Correlators Aggregators Persistor Aggregators Correlators EB, ESM, ... Rule Audit Standard Rules, Pre-persistence Rules Light-weight Rules Data Monitors Where correlation happens 12
Deployment and Sizing
Sample 3 Node Configuration ESM Node 1 ESM Node 2 ESM Node 3 Correlator Mbus_data Correlator Mbus_data Persistor Aggregator Aggregator Mbus_control Mbus_control Repo Mbus_control Repo Repo Includes DCache) Persistor deployed to single node Number of correlator, aggregator, mbus, distributed cache and repository can be adjusted as needed across nodes Actual layout of services may be changed based on capacity requirements 2 Correlators are recommended if the number of cores is 24 or greater, and the network is 10 Gbit or greater. 14
Sample 4 Node Configuration - PREFERRED ESM Node 1 ESM Node 2 ESM Node 3 ESM Node 4 Persistor Correlator Mbus_data Correlator Mbus_data Aggregator Mbus_data Repo Aggregator Mbus_control Correlator Mbus_control Aggregator Mbus_control DCache Repo DCache Repo Includes DCache) Message Bus control deployed to three nodes due to need for odd number deployment requirement Persistor deployed to single node Number of correlator, aggregator, distributed cache and repository can be adjusted as needed across nodes Actual layout of services may be changed based on capacity requirements 1 Correlator and 2 Aggregators are recommended if the number of cores is 32 or greater 15
Sample 5 Node Configuration ESM Node 1 ESM Node 2 ESM Node 3 ESM Node 4 ESM Node 5 Persistor Correlator DCache Correlator Mbus_cont Correlator DCache Correlator Mbus_cont Repo Correlator Mbus_cont Correlator Mbus_data Correlator Mbus_data Correlator Mbus_data Aggregator Mbus_data Aggregator Aggregator Aggregator Repo Repo DCache Includes DCache) Message Bus control deployed to three nodes due to need for odd number deployment requirement Persistor deployed to single node Number of correlator, aggregator, distributed cache and repository can be adjusted as needed across nodes Actual layout of services may be changed based on capacity requirements 16
Deployment Tips Isolate persistor as much as Persistor includes embedded possible DCache Do not put mbus data on persistor node Aggregators and Mbus_Data are very memory intensive – no 3 or 5 mbus data nodes is best more than 3 total on a node for redundancy Multiple Repos for redundancy Correlators and Aggregators is a good idea make a good pair for a node, usually 2C:1A Cluster supports one persistor instance 17
Cluster Requirements No need for hardware homogeneity Must be same network protocol No direct connection required Must be in the same data center Same time zone for all nodes Same OS and same OS version 18
7.0 Cluster Monitoring Features
Monitoring the ESM 7 cluster Dashboard in ACC to monitor cluster “check engine light” in the console Manage connectivity to MB and DC Manage lags for correlator and aggregators Manage.jsp is updated 20
Next Steps
Next Steps Download ESM 7 Available to all customers under maintenance Can be deployed in Compact and Distributed Modes Download and Review the Documentation Available from Protect 724 Review your Requirements with SE and/or PS Find out if distributed correlation is right for you
#MicroFocusCyberSummit Thank You.
#MicroFocusCyberSummit
Recommend
More recommend
