BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Generic Third Party Integration

Posted May 24, 2011    Morey Haber

There is an inherent value to vulnerability assessment and attack data beyond the security team. Making relevant data available to other solutions, departments, and team members can streamline the vulnerability management process and ensure the workflow is seamless between departments and management. In addition, having tight data integration makes it easier to document workflow processes required by most regulatory compliance initiatives. Take for example this simple diagram for Retina CS and a generic integration into the Windows Application Log.

Critical events can be filtered as they entered into the management console and forwarded to the Application Log. Any third party event log watcher can trigger from these events to perform addition actions or notify appropriate individuals. This simple process can be documented as follows:

  • Perform periodic vulnerability scans
  • Set a threshold for events to be replicated into the Windows Application Log
  • Have Log Management System “x” or Network Management System “y” monitor for these events
  • Perform an automated rule when these are detected. For example, open a help desk tick after correlating the data with a CMDB, send an alert to the system owner outside of the security department, or perform an automated action.
  • This type of generic integration can be used to tie virtually any system to eEye’s solutions and raise the value of the data being collected without the need for any custom code. In addition, eEye supports the following generic integration points into each of our solutions.

    Based on these, a client can do everything from custom control of the scan engine to direct access of the data warehouse and integrated alerting functions. Some custom integrations that have been performed by our clients include:

  • Extraction of data for companywide ticketing system using XML.
  • Export of results for supplemental information to an enterprise level asset inventory system.
  • Security notification of rogue devices and any other detected anomaly including new ports being opened, etc.
  • Custom web pages hosting resulting data including SharePoint
  • Allow users to initiate their own scans and view results.
  • To that end, eEye has embarked on an aggressive third party integration program (with our partners) the following out of the box integrations that go far beyond basic event log scraping.

    These solutions work seamlessly with eEye to raise the awareness of vulnerability assessment data and provide a streamlined workflow for your business requirements. For more information regarding eEye and our third party integrations, please click here.

    Additional articles

    dave-shackleford-headshot

    Why You Still Suck at Patching…and How to Turn Your Life Around

    Posted March 25, 2015    Dave Shackleford

    Live webinar | March 26, 2015 | 10am PT/1pm ET | Dave Shackleford, SANS Instructor | Why You Still Suck at Patching…and How to Turn Your Life Around

    Tags:
    , ,
    infographic

    Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls

    Posted March 24, 2015    Scott Lang

    BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks.

    Tags:
    ,
    webinar_ondemand

    On Demand Webinar – A Security Expert’s Guide: The Windows Events You Should be Tracking and Why

    Posted March 23, 2015    Lindsay Marsh

    On-Demand Webinar – Windows Security Expert and MCSE, Russell Smith, discusses the Windows Events you should be tracking right now and why. He will also show you how to set up Event Log subscriptions so you have better monitoring across your Windows environments.

    Tags:
    , ,