NetWitness Community

Anonymous · ‎2017-02-28

The RSA SecurID dashboard allows analysts to monitor specific identities and their behaviors. It empowers organizations to monitor two-factor environments that utilize RSA's SecurID for authenticating to protected resources. Users can run reports using the NetWitness Report Engine, either ad-hoc or on a recurring schedule.

Sample dashboard screen:

Dashlets Contained in this Dashboard

The SecurID dashboard contains the following dashlets:

RSA SecurID-Account Lockouts
RSA SecurID-Bad PIN Good Token Code
RSA SecurID-Bad PIN Previous Token Code
RSA SecurID-Bad Token Code Bad PIN
RSA SecurID-Bad Token Code Good PIN
RSA SecurID-Static Passcode Authentication
RSA SecurID-Token Code Reuse
RSA SecurID-Unknown User Failed Login

Prerequisites

Before you can deploy the RSA SecurID dashboard, you must meet the following prerequisites:

Must be a logs customer
Must be ingesting RSA SecurID logs
Must be using Security Analytics 10.6.x

Deployment

The RSA SecurID dashboard is not currently delivered through Live. Rather, you need to download a configuration file and add it into your RSA NetWitness Suite UI.

You need to download the following attachments from the blog post:

RSA_SecurID_Charts.zip (charts)
RSA_SecurID.cfg (dashboard)

Perform the following procedures to deploy the RSA SecurID Dashboard:

Add the Result Meta Key to Configuration Files
Add a Data Source to a Reporting Engine
Import Charts Archive
Set the Data Source on Each Chart
Enable the Charts
Import the Dashboard Configuration File
Choose Dashlet Charts

Add the Result Meta Key to Configuration Files

To get value out of this dashboard, you need to index the result meta key.

To add result key to RSA NetWitness Suite:

Update index-concentrator-custom.xml on the Concentrator, as follows:
1. In the Security Analytics menu, select Administration > Services, and select a Concentrator.
2. Select View > Config from the Actions menu.
3. Select the Files tab, then select the index-concentrator-custom.xml file.
4. Add the following line:
  <key description="Result" level="IndexValues" name="result" format="Text" valueMax="10000" defaultAction="Open"/>
5. Click Apply.
6. Restart the Concentrator Service.
Update table-map-custom.xml on the Log Decoder, as follows:
1. In the Security Analytics menu, select Administration > Services, and select a Log Decoder.
2. Select View > Config from the Actions menu.
3. Select the Files tab, then select the table-map-custom.xml file.
4. Add the following line:
  <mapping envisionName="result" nwName="result" flags="None" format="Text" envisionDisplayName="Result|Volume|Information|Reason|Succeed/Failed"/>
5. Click Apply.
6. Restart the Log Decoder service.
Remember to restart both the Index Decoder and Concentrator services that you updated, so that your changes are applied.

Add a Data Source to a Reporting Engine

In most cases, for customers that have other reports running, the Data Source is already defined. If so, you can skip this section.

Perform the following steps to associate a data source with a Reporting Engine:

In the Security Analytics menu, select Dashboard > Administration > Services.
In the Services Grid, select a Reporting Engine service.
Click View > Config.
The Services Config View of Reporting Engine is displayed.
In the Sources tab, click Available Services.
Select the Concentrator as the Data source.

Import Charts Archive

Download the Charts archive, RSA_SecurID_Charts.zip, which is attached to this blog post.
In the Security Analytics menu, select Reports.
Click Charts.
From the Chart Groups panel, select a folder to import the file.
Do one of the following:
- ln the Chart Groups panel, click Import.
- In the Chart toolbar, click Import.
Click Browse to navigate to the binary file.
Security Analytics provides a file system view of the files.
Locate the RSA_SecurID_Charts.zip file that you downloaded in step 1, and click Open.
The file is added to the Import Chart list. The RSA SecurID rules are available through Live. If you have deployed the rules from Live, then choose to not overwrite on Import.
(Optional) To overwrite any existing rule in the library with an identically named rule in the binary file when importing, check the Rule checkbox. If you do not select the Overwrite option, and an identical rule is encountered in the binary file, the binary file is imported and no error message is displayed.
(Optional) To overwrite any existing chart in the library with an identically named chart in the binary file when importing, check the Chart checkbox. If you do not select the Overwrite option and an identical chart is encountered in the binary file, the binary file is imported and no error message is displayed.
Click Import to import the binary file.

Set the Data Source on Each Chart

For each imported chart, go to Reports > Charts.
Select the Chart and click the edit Icon.
Select the Data Source for each Chart (set to the Concentrator where the Secure ID logs are being aggregated).
Click Save.

Enable the Charts

To enable the charts, do the following:

In the Security Analytics menu, select Reports.
Click Charts.
Click Identity Group.
The RSA SecureID folder appears.
Select the RSA SecureID folder.
All charts related to RSA SecureID are listed under the Charts list panel.
In the Charts list panel, select a chart or several charts that display in the Enabled column.
Click .

A confirmation message indicates that the chart(s) state is changed successfully.

Import the Dashboard Configuration file

Important: Importing a dashboard only works on 10.6.x systems, because of known permission issues importing Dashboards into 10.5.x (or prior releases).

Download the dashboard configuration file, RSA_SecurID.cfg, which is attached to this blog post.
In the dashboard toolbar, select Import Dashboard.
Browse to the dashboard file in the Import Dashboard dialog.
Click Import Dashboard.
Reconnect the dashlet to each corresponding report dashlet by clicking the icon shown in the following illustration.

The dashboard is displayed in the UI.

Choose Dashlet Charts

After importing the Dashboards, the RSA SecurID Dashboard Dashlets need to be associated with corresponding dashlet charts.

After the Dashboard is imported, the screen looks something like this:

To select charts for the dashlets:

Click on the Dashlet setup Icon, .
The dashlet Options dialog box is displayed.
Click Browse to choose the chart to display.
On the Select Charts windows under the Groups menu, select the Identity folder.
Select the RSA SecurID folder.
For each chart listed, select its checkbox and then click Select.
In the Options dialog box, click Browse and select the chart that matches the name shown in the Title.
Click Select.
Click Apply.
Repeat steps 1–8 for each dashlet in the dashboard.

Dependencies

The RSA SecurID Dashboard only applies to customers collecting from logs. Thus, All the dashlets for this dashboard have a medium of Log.

The following table describes the dependencies for each dashlet, as well as other details.

Dashlet	Dependencies
Dashlet	Report Rule	Report Chart	Other
RSA SecurIDBadPIN Good Token Code	RSA SecurIDBadPIN Good Token Code	RSA SecurIDBadPIN Good Token Code	The RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) is required.
RSA SecurIDBadPIN Previous Token Code	RSA SecurIDBadPIN Previous Token Code	RSA SecurIDBadPIN Previous Token Code
RSA SecurIDBadToken Code Bad PIN	RSA SecurIDBadToken Code Bad PIN	RSA SecurIDBadToken Code Bad PIN
RSA SecurIDBadToken Code Good PIN	RSA SecurIDBadToken Code Good PIN	RSA SecurIDBadToken Code Good PIN
RSA SecurIDStatic Passcode Authentication	RSA SecurIDStatic Passcode Authentication	RSA SecurIDStatic Passcode Authentication
RSA SecurIDToken Code Reuse	RSA SecurIDToken Code Reuse	RSA SecurIDToken Code Reuse
RSA SecurIDUnknownUser Failed Login	RSA SecurIDUnknownUser Failed Login	RSA SecurIDUnknownUser Failed Login
RSA SecurIDAccount Lockouts	RSA SecurIDAccount Lockouts	RSA SecurIDAccount Lockouts