pta - network sensoragent v网络传感器代理

PrivilegedthreatanalyticsNetworkSensor&AgentV10.4.1Uponcompletionofthissessiontheparticipantwillbeableto:DescribethemainfunctionalityoftheNetworkSensorInstallthePTAAgentonaWindowsServersessionObjectivesPTADataSourcesPrivilegedThreatAnalyticsCollectfine-grainedinformationonindividualprivilegedusersfor

UserandEntityBehaviorAnalysisCyberArkVaultCollectnetworktrafficforanalysisanddetectionofdamagingKerberosattacksNetworkTapSIEMCollectendpointaccesslogsforbehavioranalysisondevicesandcorrelationwithprivilegeduserinformationActionablePrivilegedThreatIntelligenceActiveDirectoryQueryActiveDirectoryforunderstandingtheconfigurationandstateofthedomainPTAnetworkDetectionsPTADetectionVaultSIEMNetworkADPrivilegedaccessduringirregularhoursExcessiveaccesstoprivilegedaccountsPrivilegedaccessfromirregularIPActivedormantuserMachineaccessedduringirregularhoursAnomalousaccesstomultiplemachinesSuspectedcredentialstheftUnmanagedprivilegedaccessGoldenTicketattackOverpasstheHashattackPACattackMaliciousRetrievalofDomainAccounts(DCSync)ExposedcredentialsUnconstraineddelegationSuspiciousactivitiesdetectedinaprivilegedsessionNetworksensorNetworkSensorDeploymentOptionsStandardInstallationNetworkSensorwithNetworkTapAggregatorDomainControllerDomainControllerDomainControllerDomainControllerDomainControllerNetworkTapAggregatorPTANetworkSensorPrivilegedThreatAnalyticsNetworkSensorwithoutaNetworkTapAggregatorDomainControllerDomainControllerDomainControllerDomainControllerDomainControllerNetworkSwitchesPTANetworkSensorsPrivilegedThreatAnalyticsPortMirroringConfigurationPromiscuousModeConfigurationInstallingandConfiguringaNetworkSensorTherearetwooptionsfordeployingaPTANetworkSensorVirtualApplianceFullInstallationNetworkSensorConfigurationAlsoawizardbasedprocedureStepsfocusonnetworkconfigurationandEthernetInterfacesAfterthenetworkconfigurationrunthehardeningprocedureDataFlow–NetworkSensorPTAServer/opt/ag/dat/broker/<SensorIP>/eventsFileName:DR1_EVENTS.<type>_<timestamp>Agg_brokerrsyncSend_json.pyListenerProcessNetworkSensor/home/broker/eventsPort11614dpdk-vrtdpdk_cliAggNetworkSensorTroubleshootingFromtheSensorsideServicesontheSensor:dpdk-vrtdpdk_cliAgg-takesthenetworkinfoandcreatestheeventsFromthePTASide:CSVFiles/home/broker/eventsWrittentothediskevery30secondsSavedfor2hoursonthenetworksensorCanbe3typesofCSVfilesKerberosLDAPDCsyncDiagnosticTool-/opt/ag/bin/ns_diag.shDiagnosticTool-probeshellLogs/opt/ag/logs/swMgr.log-InformationabouttheNetworkSensorservices/opt/ag/logs/agdb.Aggregator1.log-MainlogfilefortheNetworkSensorPTAAgentBackground&MotivationCyberArk’sNetworkSensorwastheonlydatasourceforKerberosandLDAPincidents/risks.NetworkSensordisadvantages:DifficultDeployment–RequiresinstallationofdedicatedVM/appliance.NeedtoconfiguremorethanoneNIC.Additionalnetworkconfigurations–promiscuousmodeorportmirroring.Resources–Atleast8coresand8GBRAM.ThePTAWindowsAgentSolutionPTAAgentisinstalledonWindows,functioninginoneoftwodataanalysismodes:Network–ThePTAAgentisinstalledonaDomainController,listenstotrafficandidentifiesKerberosandLDAPevents.UsesWinPCAPdrivers(npfservice–alsousedbyWireShark)CanbecombinedwithNetworkSensorfordifferentpurposes(forexample:PTAAgentonVMsandNetworkSensoronphysicalappliances).WindowsEvents–PTAAgentisinstalledonaWEF(WindowsEventForwarding)Server,ordirectlyonclients,listeningto4624(logon)WindowseventsandforwardsthemtothePTAServer.PTAAgentNetworkForDomainControllersecurityreasons,PTAAgentistheoneinitiatingconnectionwithPTAServer(unlikeNetworkSensor).2ConnectionsbetweenPTAAgentandPTA:DataconnectionPTAAgentlistenstotrafficandcreatesevents.TheseeventsaresentoverTCPtothePTAServerimmediatelyastheyoccur.Controlconnection“Keepalive”connection,usedforcontrollingthePTAAgentremotely.Everyfewseconds,thePTAAgentasksPTAifithasrequestsofanykind.PTAServerSidedcaservercomponent:Disabledbydefault.

Attempttostart3times(perday).RemainsupifPTAAgentisconfigured(“enable_dcagent_connection=true”andTasknameis“DCAServerReActivateTask”)Servicename:ptadcaserverdListenson2ports–6514(SSLdata)&7514(SSLcontrol)ThePTAAgentInstallationInstallationconsistsoftwosteps:Runningthecommandlinecreatorscript–AninteractiveBATscript.Theoutputisacommandlinethatshouldbecopiedandrunasanadministrator.RunningtheMSIinstaller-RuntheinstallerbypastingtheoutputoftheBATscript.MSIformat-canbedeployedwithGPO.Shouldrunasanadministrator.PTAAgentConfigurationsConfigurationsaresetinC:\ProgramFiles\CyberArk\PTAAgent\config.ini.AllparameterswiththeircurrentvaluesareprintedtothemainPTAAgentlogwhenthePTAAgentservicestarts(logsarelocatedat%ProgramData%).ConfigurationonPTAServerside: enable_network_sensor_connection=true enable_dcagent_connection=true syslog_port_ssl_data_tcp=6514 syslog_port_ssl_control_tcp=7514 enable_client_verification=trueNetworkSensorconnectionmustbeenabledinorderforPTAAgenttoconnect.InstallationFolderInstallationfolder:Whatisinstalled?PTAAgent.exe -ThePTAAgentexecutable. -NeedtorunitasAdministrator.

PTAAgentService–startsautomatically,usestheoperatingsystem’sservicemanagerinfrastructure.AgentAdministrationPTAAgentAdmin.exe–Statistics–Traffic,Kerberosevents,etc.PoolStatistics–Memoryallocation,etc.MachineMonitoring–PPS,CPUusage,resourceenforcementdata.GetStatsandwritetoCSV–sampleoptions1&3every10secondsandwritetologfile.ConfigurationFileconfig.iniParametersandvaluesprovidedduringinstallationwillbewrittentothisfile.Defaultparametersdonotappearinconfig.ini,butallconfigurationsarewrittentotheagent’sdebuglogwhentheservicestarts,andparameterscanbecopiedfromit.Everychangetoconfig.inirequiresrestartofthePTAAgentservice(nottheDC!).PTAAgentConfigurationconfig.inistructureexample: [ServerInfo] IPAddress=10.10.10.10 [DCInfo] Interface=1 LocalCLIEnabled=true ServerVerificationRequired=false [Monitoring] MachineMonitorEnabled_CPU

=false MachineMonitorEnabled_NETWORK

=true

MachineMonitorIntervalSec=10 [Enforcement]

process_CPU_enabled

=true

process_CPU_Threshold

=5

InterfacesTheinterfacePTAAgentlistenstoisinterface1bydefault.Thiscanbemodifiedduringinstallationorlaterinconfig.ini.ThelistofallidentifiedinterfacesandtheirnumbersappearinthemainPTAAgentlogfile.Ifanon-existinginterfaceisselected,PTAAgentwillfailtostart.LogsLogslocation–%ProgramData%Logfiles:pta_agent.log–mainlogofPTAAgent.benchmark_stats.log–containsoutputforPTAAgentAdmin,option4.pta