UEBA : ユーザーアクセス - 重要資産へのアクセス失敗

デフォルトで有効

いいえ

デフォルトの senseValue

5

デフォルト senseValueSource

5

デフォルト senseValueDestination

10

説明

このルールにより、重要なアセットのリファレンス・セット内に存在するシステムの認証失敗が検出されます。

サポート・ルール

必須の構成

リファレンス・セット「重要なアセット (Critical Assets)」に適切な値を追加します。

ログ・ソース・タイプ

3Com 8800 Series Switch、APC UPS、 Policy Center APC、Application Security Arpeggio SIFT-IT、Array Networks Access Gateways、Aruba Policy Manager、Aruba Mobility Controller、Avaya VPN Gateway、Barracuda Web Application Firewall、Barracuda Web Filter、 Security Platform、 Platform、Box、Bridgewater Systems AAA Service Controller、Brocade、CA CRE System、CRYPTOCard CRYPTOShield、Carbon Black Protection、Centrify Server Suite、Check Point、Cilasoft、Cisco ACS、Cisco Adaptive Security Appliance (ASA)、Cisco Aironet、Cisco Call Manager、Cisco for Catalyst Switches、Cisco Management Center、Cisco Firewall Services Module (FWSM)、Cisco IOS、Cisco Identity Services Engine、Cisco Intrusion Prevention System (IPS)、Cisco NAC Appliance, Cisco Nexus, Cisco PIX Firewall, Cisco VPN 3000 Series Concentrator, LAN Controllers, Services Module ( ), Citrix Access Gateway, Citrix Halo、Configurable Authentication message filter, Agent for Falcon Host, Custom Rule Engine, Cyber-Ark Vault, TSP Firewall/VPN, DCN DCS/DCRS Series, DG Technology MEAS, EMC VMWare、ESET Remote Administrator、Enterasys Matrix K/N/S Series Switch、Enterasys XSR Security Routers、 SF-Sherlock、Epic SIEM、Event CRE Injected、Extreme 800-Series Switch、Extreme Dragon Network IPS、Extreme Extreme Matrix Switch、Extreme Networks Operating System (OS)、Extreme Stackable and Standalone Switches、 Networks BIG-IP APM、 Networks BIG-IP LTM、 Networks Flow Classification Engine、 Fortinet Security Gateway、Foundry Fastiron、 Comware Platform、HBGary Active Defense、HP Network Automation、HP Tandem、Huawei AR Series Router、Huawei S Series Switch, Audit, Server,,, Fiberlink®, Guardium®,, (IPS), XGS, ( ),,,,,,, xml-phImperva Infoblox NIOS, Itron Smart Meter, Juniper Junos OS Platform, Juniper Junos Secure, Juniper Networks Firewall and VPN, Juniper Networks Intrusion Detection and Prevention (IDP), Juniper Networks Network and Security Manager, Juniper Steel-Belted Radius, Juniper Lieberman Random Password Manager, Magna, OS,, Application/Change Control、 Firewall Enterprise, Network IPS Appliance, Orchestrator, Microsoft IAS Server, Microsoft IIS, Microsoft ISA,, Microsoft SCOM,, Microsoft Security Event Log, Motorola Netskope Active, Nortel Application Switch, Nortel Contivity VPN Switch,Nortel Contivity VPN Switch (obsolete), Nortel Ethernet Routing Switch 2500/4500/5500、Nortel Ethernet Routing Switch 8300/8600、Nortel Multiprotocol Router、Nortel Secure Network Access Switch (SNAS)、Nortel Secure Router、Nortel VPN Gateway、Novell OS Services Qidmap、OSSEC, Okta, Open LDAP Software, OS, Acme Packet SBC, Audit Vault, BEA Listener, Enterprise Manager, RDBMS Audit Record, RDBMS OS Audit Record,, Palo Alto PA Series,Pirean Access：One, Server, Proofpoint Enterprise Protection/Enterprise Privacy, Pulse Secure Pulse Connect Secure,RSA Authentication Manager, Radware Radware Riverbed Audit, SSH STEALTHbits Security Monitoring, Skyhigh Networks Cloud Security Platform, Snort Open Source IDS, Solaris BSM, Solaris Operating System Authentication Messages, Sophos Astaro Security Gateway, Web Proxy、Starent Networks Home Agent (HA)、Stonesoft Management Center、 ASE、Symantec Endpoint Protection、 Intrusion Prevention System (IPS)、 X Series Appliances、Top Layer IPS、Trend Micro Deep Discovery Inspector、Trend Micro Deep Security、Tripwire Enterprise、Tropos Control、Universal DSM、、Venustech Venusense Security Platform、Vormetric Data Security、 Fireware OS、genua genugate、 AhnLab DbProtect, SSL VPN ClearPass Bit9Bluemix FabricOS, CA ACF2 SiteMinder, QJRN/400 CatOS FireSIGHT IronPort,Cisco Cisco Wireless Cisco WirelessWiSM NetScaler, CloudPassage CorreLog IBM® zOS, CrowdStrike CyberGuard Enterprise-IT-Security.com HiPath, E1 ExtremeWare F5 F5 F5 FirePass, ForeScout CounterACT, FortiGate FreeRADIUS, H3C IBM WebSphere® Application Server IBM i IBM z/OS® IBM zSecure Alert HyTrust CloudControl, IBM AIX® IBM AIX IBM DB2® IBM DataPower® IBM MaaS360® IBM IBM Lotus Domino IBM Proventia Network Intrusion Prevention System IBM QRadar Network Security IBM Resource Access Control FacilityRACF® IBM Security® Access Manager for Enterprise Single Sign-On IBM Security Access Manager for Mobile IBM Security Identity Governance IBM Security Identity Manager IBM SmartCloud® Orchestrator IBM Tivoli® Access Manager for e-business SecureSphere, WebApp WirelessLAN, LightCyber Linux® Mac OS X McAfee McAfee McAfee IntruShield McAfee ePolicy Microsoft Office 365 Microsoft SQL Server SharePoint, Microsoft Windows SymbolAP, eDirectory, OpenBSD Oracle Oracle Oracle WebLogic, Oracle Database OracleOracle Oracle PGP Universal Server ProFTPD AppWall, DefensePro, SteelCentral NetProfiler CryptoAuditor, StealthINTERCEPT, SafeNet DataSecure/KeySecure, Salesforce SonicWALL SonicOS, Squid Sybase TippingPoint TippingPoint VMware vCloud Director WatchGuard iT-CUBE agileSI