Index

Symboles

```Active CTI``` screen ```Alerts``` screen ```API keys``` screen ```Assets``` screen ```Auto-threshold``` screen ```Beacon detect``` screen ```Data export``` screen ```Data Management``` screen ```Detection strategy``` menu ```DGA``` screen ```Diagnostics``` screen ```Gatewatcher API``` screen ```Gatewatcher Customer Portal``` screen ```Gatewatcher support``` site ```GCaps Pairing``` screen ```Global settings``` screen ```GScan``` screen ```Health checks``` screen ```History``` screen ```Hunting``` screen ```LDAP Configuration``` screen ```License``` screen

```Malcore retroanalyzer``` screen ```Malcore``` screen ```Malicious powershell detect``` screen ```Metadata rate limiter``` screen ```Online documentation``` screen ```Overview``` screen ```Password policy``` screen ```Ransomware detect``` screen ```Relations``` screen ```Retention policy``` screen ```Retro Hunt``` screen ```Rulesets``` screen ```Shellcode detect``` screen ```Software update``` screen ```Sources``` screen ```System notifications``` command ```System Overview``` screen of the Gstats GUI ```Threat DB update``` screen ```Top risk``` screen ```update.gatewatcher.com``` screen ```Users management``` screen ```Users``` screen

A

Active CTI Alert Analysis Management of the engine Management of the engine; CTI update Management of the engine; Viewing the engine status Setting up the Active CTI engine Active CTI engine CTI module overview Events generated Introduction Active CTI, Events generated Active CTI log data structure Administrator ```Change Password``` screen ```Edit profile``` screen NDR; Configuring the NDR Setting of the retro hunt engine Administrator, account management Changing some of a local user's information Changing some of the current user's information Changing the current account password Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local users Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Managing an API access token Managing the password policy Resetting a local user's password Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions Administrator, Backup restore function Operating the backup Operating the restoration Setting the backup

Administrator, Detection engine Setting up the Active CTI engine Administrator, detection engine Setting up the beacon detect engine Setting up the Malcore engine Setting up the Malcore retroanalyzer engine Setting up the Malicious Powershell detect engine Setting up the Ransomware detect engine Setting up the Yara engine Administrator, detection motors Managing the ```Ignore list``` of the Beacon detect Managing the ```Ignore list``` of the Ransomware detect Managing the Ignore list of the Dga detect engine Managing the Ignore list of the Malcore engine Setting up the Dga detect engine Administrator, GCap administration Pairing a GCap with the GCenter Pairing again a GCap Administrator, GCenter software Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade Administrator, global configuration Connection to the GCenter web interface via a web browser Licence amendment Logging out of the GCenter web interface Administrators, Setting up the Shellcode detect engine Alerting ANSSI API Endpoints list Overview of the API interface Presentation of the tittle bar Audit trail Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions

B

Beacon Detect Alert Analysis Configuration of the engine and management of the ignored destination list Engine update Introduction Management of the engine Viewing the engine status

Beacon detect Beacon Detect engine Beacon detect log data structure Events generated Managing the ```Ignore list``` Beacon Detect engine, Events generated Events generated by the engine, [1], [2]

C

Cas d'utilisation, membre groupe Administrator, Setting up the Shellcode detect engine Cas d'utilisation, membre groupe operator, gestion SIGFLOW Creation of automatic alarm limits Characteristics Electrical characteristics Functional characteristics Mechanical characteristics CLI Configuration menu ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Elasticsearch storage mode``` command ```Exit``` command ```Gcenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command Overview

Critical risk CTI Active CTI engine Retro hunt engine CTI, Events generated Example of a Active CTI alert in the WebUI CTI, Events generated by the Retro Hunt engine Example of Retro hunt alert in the WebUI

D

DGA detect Alert Analysis Analysing the DGA detect alerts Configure the DGA detect engine and manage the list of ignored files DGA detect log data structure Events generated Management of the engine Update Viewing the engine status

DGA detect engine Introduction DGA Detect, Events generated Events generated by the engine DGA detect, Events generated Example of alert in WebUI

E

Ecran ```Association rules``` Ecran ```GCaps profiles``` Ecran ```Yara engine```

Engine hash External integration Introduction MISP Server

G

GCap Presentation of the GCap GCap configuration Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure the flow timeouts via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via a GCap profile Configuring the network variables parameters via the GCap profile GCenter Licence amendment Presentation of the GCenter

GCenter, Presentation of the GCenter Different server models List of the GCenter inputs / outputs Gscan Detecting with Gscan Introduction of the GScan detection Gstats ```System Overview``` screen of the Gstats GUI Presentation of the tittle bar

H

High risk

Hotfix overview

I

Interconnection Interconnection between devices Interface graphique Kibana ```System logs``` screen Interface web UI ```Active CTI``` screen ```Malcore retroanalyzer``` screen ```Malicious powershell detect``` screen ```Retro Hunt``` screen ```Shellcode detect``` screen ```Yara engine``` screen

K

Kibana GUI Data exploitation Kibana GUI overview Native dashboards, [1], [2] overview

L

LDAP LDAP user Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Legacy web UI ```Backup operations``` screen ```Configuration``` screen ```MISP settings``` screen ```Netdata Export Configuration``` screen ```Netdata polling``` screen Description of the legacy WEB UI Overview of the traditional WEB UI Traditional interface navigation bar

List of accounts Local user Changing some of a local user's information Creating local users Deleting a local user Resetting a local user's password Logging Low risk

M

Machine Learning Managing the Ignore list of the Dga detect engine Setting up the Dga detect engine Malcore Alert Analysis Analysing the Beacon Detect alerts Analysing the Malcore alerts Events generated Introduction Malcore engine Management of the engine Management of the engine; Engine update Management of the engine; Malcore configuration and management of the ignored list feature Management of the engine; Viewing the engine status Managing the Ignore list of the Malcore engine Setting up the Malcore engine Malcore retroanalyzer Alert Analysis Analysing the Malcore retroanalyzer alerts Configuration of the engine and management of the ignored files list Engine update Events generated Management of the engine Presentation Setting up the Malcore retroanalyzer engine Viewing the engine status

Malcore, Events generated Malcore log data structure Malicious Powershell Detect Analysing the Malicious Powershell Detect alerts Analysing the Yara alerts Malicious Powershell detect Alert Analysis Engine configuration Engine update Introduction Management of the engine Setting up the Malicious Powershell detect engine Viewing the engine status Malicious Powershell detect, Events generated Example of a Powershell alert in the webui Medium risk Metadata rate limiter ```Metadata rate limiter``` screen Mitre MTU

N

Netdata Overview of the Netdata User Interface

Netdata Gstats ```System Overview``` screen of the Gstats GUI

O

OIV Operator Analysing the Active CTI alerts Analysing the Beacon Detect alerts Analysing the DGA detect alerts Analysing the Malcore alerts Analysing the Malcore retroanalyzer alerts Analysing the Malicious Powershell Detect alerts Analysing the Ransomware detect alerts Analysing the Shellcode detect alerts Analysing the Sigflow alerts Analysing the Yara alerts Configuring Metadata Rate Limiters Session management;Connection to the GCenter web interface via a web browser Session management;Logging out of the GCenter web interface Operator, account management Changing some of the current user's information Changing the current account password Operator, GCap configuration Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure the flow timeouts via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via a GCap profile Configuring the network variables parameters via the GCap profile

Operator, gestion SIGFLOW Creation of automatic alarm limits Operator, Gscan Detecting with Gscan Operator, Kibana dashboards Using of the Kibana dashboards Operator, NDR dashboards Using of NDR dashboards Operator, SIGFLOW management Creating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources Updating rules sources OTP

R

RAID1 RAID5 Ransomware detect Alert Analysis Analysing the Ransomware detect alerts Configuration of the engine and management of the ignored files list Engine management; Update Engine management; Viewing the engine status Events generated Introduction Management of the engine Managing the ```Ignore list``` Ransomware detect engine Ransomware detect engine Setting up the beacon detect engine Setting up the Ransomware detect engine Ransomware detect, Events generated Logs data structure

Reflex Presentation of Reflex Retro Hunt Alert Analysis Engine management; Update Engine management; Viewing the engine status Retro hunt Management of the engine Retro Hunt engine Events generated Retro hunt engine CTI module overview Retro hunt, generated events Retro hunt log data structure retrohunt Setting of the retro hunt engine Retrohunt engine Analysing the Retro hunt alerts

S

setup, [1] ```About``` Command ```Arp Manager``` command ```DateTime``` command ```Diagnose``` command ```Elasticsearch storage mode``` command ```Exit``` command ```Gcenter Services Management``` command ```Keyboard``` command ```LPM Mode``` command ```Network``` command ```Password``` command ```Reset``` command ```Restart``` command ```Shutdown``` command ```Tech Support``` command Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu with keyboard and monitor Functions allowed in the setup account Related principles setup account Direct connection to the GCenter configuration menu via SSH Shellcode detect Alert Analysis Analysing the Shellcode detect alerts Engine configuration Management of the engine shellcode detect Engine update Introduction Viewing the engine status Shellcode Detect engine, Events generated Events generated by the engine shellcode detect, Events generated Example of a Shellcode log Shellcode log data structure shellcode detect, Shellcode detect engine SIEM Sigflow Alert Analysis Analysing the Active CTI alerts Analysing the Sigflow alerts Detailed operation of the rules Engine update GCAP Profiles; GCAP Profiles Introduction Management of the engine Organizing the rules Sigflow engine Sigflow engine signature sources Sigflow Setup Structure of sigflow logs View the status of Sigflow

Sigflow Rulesets Changing signatures Definition of signatures Generating rulesets Optimization of rulesets Removing or limiting the number of alerts Rulesets Sigflow, Events generated Events generated by the engine Events of type "alert" Events of type "fileinfo" Events of type "meta-data" Example of "alert" Sigflow events in the WebUI Log data of type "alert" Sigflow, GCap configuration Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configure the flow timeouts via the GCap profile Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via a GCap profile Configuring the network variables parameters via the GCap profile Sigflow, GCAP Profiles Alerting et logging Base variables Community ID Detection Rulesets File rule management Flow timeouts HTTP Proxy Multi-tenant by interface Multi-tenant by VLAN Net variables Packet filtering Payload Single-tenant Stream analysis and file extraction Sigflow, gestion SIGFLOW Creation of automatic alarm limits Sigflow, SIGFLOW management Creating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources Updating rules sources Syslog servers Introduction Logstash SIEM SIEM Splunk

T

TAP Overview of the TAP Threat DB update Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade

threat-DB update et software update overview Token Managing an API access token Managing the password policy

U

Update overview Update automatic Update manual Update presentation Upgrade overview Use case, Analysing the Active CTI alerts Use case, Analysing the Sigflow alerts Use case, member of Administrator group NDR; Configuring the NDR Use case, member of Administrator group, account management Changing some of a local user's information Configuring the connection between the GCenter and the LDAP server Configuring the users and groups defined on LDAP / ActiveDirectory Creating local users Deleting a local user Displaying of the connection status between the GCenter and the LDAP server Enable the connection between the GCenter and the LDAP server Managing an API access token Managing the password policy Resetting a local user's password Viewing the authentication history Viewing the history function for all changes in user rights Viewing the history of user creations or deletions Use case, member of Administrator group, administration GCap Pairing a GCap with the GCenter Pairing again a GCap Use case, member of Administrator group, Backup restore function Operating the backup Operating the restoration Setting the backup Use case, member of Administrator group, detection engine Managing the Ignore list of the Malcore engine Setting up the beacon detect engine Setting up the Malcore engine Setting up the Malcore retroanalyzer engine Setting up the Malicious Powershell detect engine Setting up the Ransomware detect engine Setting up the Yara engine Use case, member of Administrator group, detection motors Managing the ```Ignore list``` of the Beacon detect Managing the ```Ignore list``` of the Ransomware detect Managing the Ignore list of the Dga detect engine Setting up the Dga detect engine Use case, member of Administrator group, GCenter software Configuring automatic update via Threat DB update Installing a hotfix Installing an update manually Installing of an upgrade

Use case, member of Administrator group, global configuration Licence amendment Use case, member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, member of group Administrator, Detection engine Setting of the retro hunt engine Setting up the Active CTI engine Use case, Member of operator group Analysing the Beacon Detect alerts Analysing the Malcore alerts Analysing the Malicious Powershell Detect alerts Analysing the Shellcode detect alerts Analysing the Yara alerts Use case, member of Operator group Analysing the DGA detect alerts Analysing the Malcore retroanalyzer alerts Analysing the Ransomware detect alerts Configuring Metadata Rate Limiters Use case, member of Operator group, account management Changing some of the current user's information, [1] Changing the current account password, [1] Use case, member of Operator group, Configure the flow timeouts via the GCap profile Use case, member of Operator group, GCap configuration Configure File Reconstruction Rules (File rules management) Configure filters on targeted parts of the analyzed traffic (Packet filters) Configuring the Base variables parameters via the GCap profile Configuring the detection rulesets via a GCap profile Use case, member of Operator group, Gscan Detecting with Gscan Use case, member of Operator group, Kibana dashboards Using of the Kibana dashboards Use case, member of Operator group, NDR dashboards Using of NDR dashboards Use case, member of Operator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Use case, member of Operator group, SIGFLOW management Creating a SIGFLOW engine ruleset Modifying SIGFLOW engine rules SIGFLOW engine rule sources Updating rules sources Use case, member of Operator group,Configuring the network variables parameters via the GCap profile Use case, Setup account Direct connection to the GCenter configuration menu via SSH Use case, setup account Direct connection to the GCenter configuration menu in HTTP via iDRAC (DELL server) Direct connection to the GCenter configuration menu SSH via the iDRAC interface in serial port forwarding mode Direct connection to the GCenter configuration menu with keyboard and monitor

W

Web interface accounts and their management Web Interface Accounts web UI ```Malcore``` screen Web UI ```Home``` screen Web UI Interface ```Alerts``` screen ```Assets``` screen ```GScan``` screen ```Health checks``` screen ```Home``` screen ```Hunting``` screen ```Overview``` screen ```Relations``` screen ```Top Relations``` screen, [1] ```Top risk``` screen ```Users``` screen Central screen Navigation bar Overview of the WEB UI Presentation of the tittle bar

Web UI, account management Changing some of the current user's information, [1] Changing the current account password, [1] Web UI, member of Administrator group, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface Web UI, Session management Connection to the GCenter web interface via a web browser Logging out of the GCenter web interface

Y

Yara Setting up the Shellcode detect engine Setting up the Yara engine Yara engine Alert Analysis Configuration of the engine Events generated Introduction Management of the engine Update Viewing the engine status Yara engine