4.2 SmartEvent Custom Events, Alerts, & Reports

Custom Event Definitions in SmartEvent

While SmartEvent provides hundreds of pre-defined Event Definitions out-of-the-box (covering malware outbreaks, brute-force attacks, and unauthorized access), enterprise Security Operations Centers (SOCs) frequently need to define custom events tailored to internal security policies or unique threat vectors.

Creating a Custom Event Definition in SmartConsole involves configuring five essential parameters using the Event Definition Wizard:

+-----------------------------------------------------------------------+
|                   Custom Event Definition Parameters                  |
+-----------------------------------------------------------------------+
| 1. General Properties : Event Name, Severity (Critical/High/Med/Low)  |
| 2. Product & Blade    : Filter by Firewall, IPS, Anti-Bot, DLP, etc.  |
| 3. Filter Criteria    : Match fields (Source, Dest, Port, Action)     |
| 4. Threshold & Window : Occurrence count (e.g. 20) in time (e.g. 60s) |
| 5. Grouping           : Aggregate by Source IP, Dest IP, or User      |
+-----------------------------------------------------------------------+

Detailed Parameter Configuration

1. Event Identifiers: Assign a unique name, description, category (e.g., Ransomware, Data Exfiltration), and severity level (Critical, High, Medium, Low).
2. Product / Blade Selection: Restrict log evaluation to specific Software Blades (e.g., evaluate only Anti-Bot infection logs or Access Control drop logs).
3. Log Property Filters: Match specific key-value pairs in raw logs, such as Action = Drop, Service = SSH (22), or Resource = /admin/login.
4. Thresholds & Time Windows: Define the event trigger boundary. For example, trigger an event only when 20 matching drops occur within a 30-second window.
5. Grouping ('Group By'): Determines how log entries are aggregated:
   • Group by Source IP: Tracks activity per attacking host (e.g., detecting a single internal machine conducting an internal network scan).
   • Group by Destination IP: Tracks activity per targeted server (e.g., detecting a Distributed Denial of Service attack against a web server).
   • Group by User: Tracks activity per authenticated Identity Awareness user (e.g., detecting multiple failed VPN logins from a specific username).

---

Automatic Reactions & Incident Remediation

When SmartEvent confirms a security event, it can automatically execute one or more Automatic Reactions to mitigate the threat instantly without requiring manual SOC operator intervention.

Deep-Dive: Suspicious Activity Monitoring (SAM)

SAM rules are dynamic, kernel-level enforcement commands that instruct the Security Gateway's SecureXL acceleration table (fwaccel) and active inspection engine to drop or rate-limit traffic from specific source/destination IPs or subnets.

Key exam facts regarding SAM blocks triggered by SmartEvent:

• SAM rules take effect immediately without compiling or installing a Security Policy.
• SAM rules can be configured with an automatic expiration timeout (e.g., block for 3,600 seconds / 1 hour).
• SAM commands do not alter the persistent policy.fws management database, preserving rulebase integrity.

---

SmartEvent GUI Views & Dashboard Customization

Within SmartConsole under the Logs & Monitor tab, SmartEvent provides interactive visual dashboards and custom view capabilities:

• Threat Map: Displays geographic origins of incoming cyber attacks based on IP geolocation data.
• Timeline Views: Graphs event volume over time to identify activity spikes corresponding to incident outbreaks.
• Top Attackers & Top Targets Widgets: Summarizes the most aggressive external threat sources and most targeted internal assets.
• Custom View Creation: Administrators can build tailored SOC views using structured query syntax (e.g., blade:"Anti-Bot" AND severity:"Critical" AND action:"Prevent"), allowing analysts to isolate specific threat categories with one click.

---

Executive & Technical Compliance Reporting

SmartEvent includes an integrated Report Generator (incorporating features legacy administrators recognize from SmartReporter). The Report Generator produces polished, highly structured reports for executive leadership, audit teams, and network administrators.

Report Building & Templates

• Pre-Packaged Templates: Includes ready-to-use reports such as Executive Summary, PCI-DSS Regulatory Compliance, Cyber Threat Assessment, Bandwidth & Application Usage, and IPS Incident Summary.
• Custom Report Design: Administrators can combine multiple visual widgets, charts (pie, bar, trend lines), tabular data, cover pages, and custom narrative text blocks into a consolidated document.

Report Scheduling & Distribution

The Report Generator supports automated execution schedules:

• Recurrence: Daily, Weekly (on specified days), or Monthly (on the 1st of the month).
• Output Formats: PDF, HTML, and CSV.
• Distribution Channels: Automated email distribution via SMTP to configured recipient lists, or direct export to local/network directory paths (/var/smartevent/reports/).