Index

Symbols

```Active CTI``` screen ```Alerts``` screen ```API keys``` screen ```Assets``` screen ```Association rules``` screen ```Auto-threshold``` screen ```Backup operations``` screen ```Beacon detect``` screen ```Configuration``` screen ```Data export``` screen ```Data Management``` screen ```DGA detect``` screen ```Diagnostics``` screen ```Gatewatcher API``` screen ```Gatewatcher Customer Portal``` screen ```Gatewatcher support``` Screen ```GCaps Pairing``` screen ```GCaps profiles``` screen ```Global settings``` screen ```GScan``` screen ```Health checks``` screen ```History``` screen ```Home``` screen ```Hunting``` screen ```LDAP binding``` screen ```License``` screen

```Malcore retroanalyzer``` screen ```Malcore``` screen ```Malicious Powershell detect``` screen ```Metadata rate limiter``` screen ```MISP settings``` screen ```Netdata Export Configuration``` screen ```Netdata polling``` screen ```Network settings``` screen ```Online documentation``` screen ```Overview``` screen ```Password policy``` screen ```Ransomware detect``` screen ```Relations``` screen ```Retention policy``` screen ```Retro Hunt``` screen ```Shellcode detect``` screen ```Software update``` screen ```Sources``` screen, [1] ```System notifications``` command ```System Overview``` screen of the Gstats GUI ```Threat DB update``` screen ```Top Relations``` screen ```Top risk``` screen ```update.gatewatcher.com``` screen ```Users management``` screen ```Users``` screen ```YARA``` screen

A

Active CTI Alert Analysis CTI module overview Events generated Introduction Management of the engine Management of the engine; CTI update Management of the engine; Viewing the engine status Setting up the Active CTI engine Active CTI, Events generated Active CTI log data structure Administrator NDR; Configuring the NDR Setting up a Netdata server Administrator, Account management Changing some of a local user's information Changing some of the current user's information Changing the checking account password Configuring the authentication history Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local user Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enabling the connection between the GCenter and the LDAP server Managing an API access token Managing the password policy Resetting a local user's password Viewing the authentication history Administrator, Active CTI Setting up the Active CTI engine Administrator, Backup restore function Operating the backup Operating the restoration Setting the backup Administrator, Detection engine Managing the Ignore list of the Beacon detect Managing the Ignore list of the DGA detect engine Managing the Ignore list of the Malcore engine Managing the Ignore list of the Ransomware detect Setting of the retro hunt engine Setting up the beacon detect engine Setting up the DGA detect engine Setting up the Malcore engine Setting up the Malcore retroanalyzer engine Setting up the Malicious Powershell detect engine Setting up the Ransomware detect engine Setting up the Yara engine

Administrator, GCap administration Change the default profile or customise the existing profile Pairing a GCap with the GCenter Pairing again a GCap Administrator, GCenter administration Configuring the connection to the MISP Deleting data (log files) Export data to a SIEM via the syslog protocol Export data to the ETL Logstash via syslog protocol Generating and loading files for diagnosis Quick creation of a POC Logstash Using an endpoint API Administrator, GCenter software Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade Administrator, Global configuration Configuring the Netdata export interface Configuring the Netdata polling interface Connection to the GCenter web interface via a web browser GCenter global configuration Logging out of the GCenter web interface Managing the license Using a Netdata server Administrator, Setting up the Shellcode detect engine Alerting ANSSI API Endpoints list, [1] Overview of the API interface Presentation of the tittle bar Using an endpoint API Audit trail Configuring the authentication history Viewing the authentication history

B

Beacon detect Alert Analysis Beacon detect engine Beacon detect log data structure Configuration of the engine and management of the ignored destination list Engine update Events generated Introduction Management of the engine Managing the Ignore list Viewing the engine status

beacon detect engine Setting up the beacon detect engine Beacon detect, Events generated Events generated by the engine, [1]

C

Characteristics Electrical characteristics Functional characteristics Mechanical characteristics CLI Configuration menu ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Elasticsearch storage mode``` command ```Exit``` command ```GCenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command Overview

Critical risk CTI Active CTI engine Retro hunt engine CTI, Events generated Example of a Active CTI alert in the WebUI CTI, Events generated by the Retro hunt engine Example of Retro hunt alert in the WebUI current account ```Change Password``` screen ```Edit profile``` screen Overview of the account management menu

D

Data use DGA detect Alert Analysis Analyzing the DGA detect alerts Configure the DGA detect engine and manage the list of ignored files DGA detect log data structure Engine update Events generated Introduction Management of the engine Viewing the engine status

DGA detect, Events generated Events generated by the engine Example of alert in WebUI

E

Engine hash External integration Introduction MISP Server

G

GApps management GCap Presentation of the GCap GCap configuration Configuring filters on targeted parts of the analyzed traffic via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via the GCap profile Configuring the file reconstruction rules via the GCap profile Configuring the flow timeouts via the GCap profile Configuring the network variables parameters via the GCap profile GCenter GCenter Global Configuration Managing the license Presentation of the GCenter GCenter software Dedicated modules for managing updates Threat DB update and Software update Hotfix presentation Overview of the backup and restoration Release note Update presentation Upgrade presentation

GCenter, Presentation of the GCenter Different server models List of the GCenter inputs / outputs GScan Detecting with GScan Gscan Introduction of the GScan detection Gstats ```System Overview``` screen of the Gstats GUI Presentation of the tittle bar

H

High risk

Hotfix overview

I

Interconnection Interconnection between devices

K

Kibana ```System logs``` screen Kibana GUI Configuration of the Kibana GUI Data exploitation Main tabs Native dashboards of the ```Administration``` tab Native dashboards of the ```Alerts``` tab Native dashboards of the ```Network Metadata``` tab overview

L

LDAP LDAP user Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Displaying of the connection status between the GCenter and the LDAP server Enabling the connection between the GCenter and the LDAP server Legacy web UI Description of the legacy WebUI Navigation bar Overview Legacy WebUI ```Backup operations``` screen ```Configuration``` screen ```MISP settings``` screen

List of accounts Local user Changing some of a local user's information Creating local user Deleting a local user Resetting a local user's password Logging Logstash Export data to the ETL Logstash via syslog protocol Quick creation of a POC Logstash Low risk

M

Machine Learning Managing the Ignore list of the DGA detect engine Setting up the DGA detect engine Malcore Alert Analysis Analyzing the Beacon detect alerts Analyzing the Malcore alerts Events generated Introduction Malcore engine, [1] Management of the engine Management of the engine; Engine update Management of the engine; Malcore configuration and management of the ignored list feature Management of the engine; Viewing the engine status Managing the Ignore list Setting up the Malcore engine Malcore retroanalyzer Alert Analysis Analyzing the Malcore retroanalyzer alerts Configuration of the engine and management of the ignored files list Engine update Events generated Management of the engine Presentation Setting up the Malcore retroanalyzer engine Viewing the engine status

Malcore retroanalyzer, Malcore retroanalyzer engine Malcore, Events generated Malcore log data structure Malicious Powershell Detect Analyzing the Malicious Powershell Detect alerts Analyzing the Yara alerts Malicious Powershell detect Alert Analysis Engine configuration Engine update Introduction Management of the engine Setting up the Malicious Powershell detect engine Viewing the engine status Malicious Powershell detect, Events generated Example of a Powershell alert in the WebUI Medium risk Metadata rate limiter ```Metadata rate limiter``` screen MISP Configuring the connection to the MISP Mitre MTU

N

Netdata Configuring the Netdata export interface Configuring the Netdata polling interface Overview of the Netdata User Interface Setting up a Netdata server Using a Netdata server

Netdata Gstats ```System Overview``` screen of the Gstats GUI

O

OIV Operator Analyzing the Active CTI alerts Analyzing the Beacon detect alerts Analyzing the DGA detect alerts Analyzing the Malcore alerts Analyzing the Malcore retroanalyzer alerts Analyzing the Malicious Powershell Detect alerts Analyzing the Ransomware detect alerts Analyzing the Retrohunt alerts Analyzing the Shellcode detect alerts Analyzing the Sigflow alerts Analyzing the Yara alerts Configuring Metadata Rate Limiters Session management;Connection to the GCenter web interface via a web browser Session management;Logging out of the GCenter web interface Operator, Account management Changing some of the current user's information Changing the checking account password Operator, GCap configuration Configuring filters on targeted parts of the analyzed traffic via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via the GCap profile Configuring the file reconstruction rules via the GCap profile Configuring the flow timeouts via the GCap profile Configuring the network variables parameters via the GCap profile

Operator, GScan Detecting with GScan Operator, Kibana dashboards Using of the Kibana dashboards Operator, NDR dashboards Using of NDR dashboards Operator, Sigflow management Creating a Sigflow engine ruleset Creation of automatic alarm limits Modifying Sigflow engine rules Sigflow engine rule sources Updating rules sources OTP Overview of the ```Detection strategy``` menu

R

RAID1 RAID5 Ransomware detect Alert Analysis Analyzing the Ransomware detect alerts Configuration of the engine and management of the ignored files list Engine management; Update Engine management; Viewing the engine status Events generated Introduction Management of the engine Managing the Ignore list`` of the Ransomware detect Ransomware detect engine Setting up the Ransomware detect engine Ransomware detect, Events generated Logs data structure

Reflex Presentation of Reflex Retro hunt Alert Analysis Analyzing the Retrohunt alerts CTI module overview Engine management; Update Engine management; Viewing the engine status Events generated Management of the engine Retro hunt, events generated Retro hunt log data structure retrohunt Setting of the retro hunt engine

S

setup ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Elasticsearch storage mode``` command ```Exit``` command ```GCenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu via SSH Direct connection to the GCenter configuration menu with keyboard and monitor Setup account Functions allowed in the setup account Related principles Shellcode detect Alert Analysis Analyzing the Shellcode detect alerts Engine configuration Engine update Events generated Events generated; Example of a Shellcode log Events generated; Shellcode log data structure Introduction Management of the engine Viewing the engine status Shellcode detect engine Setting up the Shellcode detect engine Shellcode detect, Events generated Events generated by the engine SIEM Export data to a SIEM via the syslog protocol Sigflow Alert Analysis Analyzing the Active CTI alerts Analyzing the Sigflow alerts Data structure of the Events of type "alert" Data structure of the events of type "fileinfo" Data structure of the events of type "meta-data" Detailed operation of the rules Engine update GCAP Profiles; GCAP Profiles Introduction Management of the engine Organizing the rules Sigflow engine Sigflow engine signature sources Sigflow Setup View the status of Sigflow

Sigflow Rulesets Changing signatures Definition of signatures Generating rulesets Optimization of rulesets Removing or limiting the number of alerts Rulesets Sigflow, Events generated Events generated by the engine Events of type "alert" Events of type "fileinfo" Events of type "meta-data" List of protocols in the Events of type "alert" Sigflow, GCap configuration Configuring filters on targeted parts of the analyzed traffic via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via the GCap profile Configuring the file reconstruction rules via the GCap profile Configuring the flow timeouts via the GCap profile Configuring the network variables parameters via the GCap profile Sigflow, GCAP Profiles Alerting et logging Base variables Community ID Detection Rulesets File rule management Flow timeouts HTTP Proxy Multi-tenant by interface Multi-tenant by VLAN Net variables Packet filtering Payload Single-tenant Stream analysis and file extraction Sigflow, Sigflow management Creating a Sigflow engine ruleset Creation of automatic alarm limits Modifying Sigflow engine rules Sigflow engine rule sources Updating rules sources Syslog servers Introduction Logstash SIEM SIEM Splunk

T

TAP Overview of the TAP Threat DB update Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade

Threat DB update and Software update overview Token Managing an API access token Managing the password policy

U

Update overview Update automatic Update manual Upgrade overview Use case, Analyzing the Active CTI alerts Use case, Analyzing the Sigflow alerts Use case, Member of Administrator group NDR; Configuring the NDR Use case, Member of Administrator group, Account management Changing some of a local user's information Configuring the authentication history Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local user Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enabling the connection between the GCenter and the LDAP server Managing an API access token Managing the password policy Resetting a local user's password Viewing the authentication history Use case, Member of Administrator group, Active CTI Setting up the Active CTI engine Use case, Member of Administrator group, Backup restore function Operating the backup Operating the restoration Setting the backup Use case, Member of Administrator group, Detection engine Managing the Ignore list of the Beacon detect Managing the Ignore list of the DGA detect engine Managing the Ignore list of the Malcore engine Managing the Ignore list of the Ransomware detect Setting of the retro hunt engine Setting up the beacon detect engine Setting up the DGA detect engine Setting up the Malcore engine Setting up the Malcore retroanalyzer engine Setting up the Malicious Powershell detect engine Setting up the Ransomware detect engine Setting up the Shellcode detect engine Setting up the Yara engine Use case, Member of Administrator group, GCap administration Pairing a GCap with the GCenter Pairing again a GCap Use case, member of Administrator group, GCap administration Change the default profile or customise the existing profile Use case, Member of Administrator group, GCenter administration Configuring the connection to the MISP Deleting data (log files) Export data to a SIEM via the syslog protocol Generating and loading files for diagnosis Quick creation of a POC Logstash Using an endpoint API Use case, Member of Administrator group, GCenter administration Export data to the ETL Logstash via syslog protocol Use case, Member of Administrator group, GCenter software Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade

Use case, Member of Administrator group, Global configuration Configuring the Netdata export interface Configuring the Netdata polling interface GCenter global configuration Managing the license Setting up a Netdata server Using a Netdata server Use case, Member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, Member of Operator group Analyzing the Beacon detect alerts Analyzing the DGA detect alerts Analyzing the Malcore alerts Analyzing the Malcore retroanalyzer alerts Analyzing the Malicious Powershell Detect alerts Analyzing the Ransomware detect alerts Analyzing the Retrohunt alerts Analyzing the Shellcode detect alerts Analyzing the Yara alerts Configuring Metadata Rate Limiters Use case, Member of Operator group , GCap configuration Configuring the file reconstruction rules via the GCap profile Use case, Member of Operator group , Account management Changing the checking account password Use case, Member of Operator group , GCap configuration Configuring the detection rulesets via the GCap profile Use case, Member of Operator group , NDR dashboards Using of NDR dashboards Use case, Member of Operator group , Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, Member of Operator group ,Configuring the network variables parameters via the GCap profile Use case, Member of Operator group, Account management Changing some of the current user's information, [1] Changing the checking account password Use case, Member of Operator group, Configuring the flow timeouts via the GCap profile Use case, Member of Operator group, GCap configuration Configuring filters on targeted parts of the analyzed traffic via the GCap profile Configuring the Base variables parameters via the GCap profile Use case, Member of Operator group, GScan Detecting with GScan Use case, Member of Operator group, Kibana dashboards Using of the Kibana dashboards Use case, Member of Operator group, membre groupe operator, gestion Sigflow Creation of automatic alarm limits Use case, Member of Operator group, Sigflow management Creating a Sigflow engine ruleset Modifying Sigflow engine rules Sigflow engine rule sources Use case, Member of Operator group, SIigflow management Updating rules sources Use case, Setup account Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu via SSH Direct connection to the GCenter configuration menu with keyboard and monitor

W

Web interface accounts and their management Web Interface Accounts Web interface interface accounts WebUI ```Active CTI``` screen ```Alerts``` screen ```API keys``` screen ```Assets``` screen ```Auto-threshold``` screen ```Beacon detect``` screen ```Data export``` screen ```Data Management``` screen ```DGA detect``` screen ```Diagnostics``` screen ```Gatewatcher API``` screen ```Gatewatcher Customer Portal``` screen ```Gatewatcher support``` Screen ```GCaps Pairing``` screen ```Global settings``` screen ```GScan``` screen ```Health checks``` screen ```History``` screen ```Home``` screen ```Hunting``` screen ```LDAP binding``` screen ```License``` screen ```Malcore retroanalyzer``` screen ```Malcore``` screen ```Malicious Powershell detect``` screen ```Netdata Export Configuration``` screen ```Netdata polling``` screen ```Network settings``` screen ```Online documentation``` screen ```Overview``` screen ```Password policy``` screen ```Ransomware detect``` screen ```Relations``` screen ```Retention policy``` screen ```Retro Hunt``` screen ```Rulesets``` screen ```Shellcode detect``` screen ```Software update``` screen ```Sources``` screen ```Threat DB update``` screen ```Top Relations``` screen ```Top risk``` screen ```update.gatewatcher.com``` screen ```Users management``` screen ```Users``` screen ```Yara engine``` screen Central screen Navigation bar Overview of the WEB UI Presentation of the tittle bar

WebUI, Account management Changing some of the current user's information, [1] Changing the checking account password, [1] WebUI, Member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface WebUI, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface

Y

Yara Alert Analysis Configuration of the engine Events generated Introduction Management of the engine Setting up the Yara engine Update Viewing the engine status Yara engine

Yara, Events generated Yara log data structure