Apply tags to identify and group events

Deep Security enables you to create tags that you can use to identify and sort events. For example, you might use tags to separate events that are benign from those that require further investigation. You can use tags to create customized dashboards and reports.

Although you can use event tagging for a variety of purposes, it was designed to ease the burden of event management. After you have analyzed an event and determined that it is benign, you can look through the event logs of the computer (and any other similarly configured and tasked computers) to find similar events and apply the same label to them, eliminating the need to analyze each event individually.

To view tags that are currently in use, go to Policies > Common Objects > Other > Tags.

You can perform tagging the following ways:

• Manual tagging lets you tag specific events as needed.
• Auto-tagging lets you use an existing event as the model for auto-tagging similar events on the same or other computers. You define the parameters for "similarity" by selecting which event attributes have to match the model event attributes for a tag to be applied.
• Trusted source tagging lets you auto-tag integrity monitoring events based on their similarity to known-good events from a trusted source.

Manual tagging

1. Go to Events & Reports > Events and select an event list. Right-click the event (or select multiple events and right-click) and select Add Tag(s).
2. Type a name for the tag. Deep Security Manager will suggest matching names of existing tags as you type.
3. Select The Selected [Event Type] Event. Click Next.
4. Enter some optional comments and click Finish.

In the events list, you can see your tag in the TAG(S) column.

Auto-tagging

Deep Security Manager enables you to define rules that apply the same tag to similar events automatically. To view existing saved auto-tagging rules, click Auto-Tagging in the menu bar on any Events page. You can run saved rules manually from this page.

1. Go to Events & Reports > Events and select an event list. Right-click a representative event and select Add Tag(s).
2. Type a name for the tag. Deep Security Manager will suggest matching names of existing tags as you type.
3. Select Apply to selected and similar [Event Type] Events and click Next.
4. Select the computers where you want to auto-tag events and click Next. When applying tags to system events, this page is skipped.
5. Select which attributes will be examined to determine whether events are similar. For the most part, the attribute options are the same as the information displayed in the columns of the Events list pages. When you have selected which attributes to include in the event selection process, click Next.
6. On the next page, specify when events should be tagged. If you select Existing [Event Type] Events, you can select Apply Auto-Tag Rule now to apply the auto-tagging rule immediately, or Apply Auto-Tag Rule in the background to have it run in the background at a lower priority. Select Future [Event Type] Events to apply the auto-tagging rule to events that will happen in the future. You can also save the auto-tagging rule by selecting Save Auto-Tag Rule and optionally entering a name. Click Next.
7. Review the summary of your auto-tagging rule and click Finish.

In the events list, you can see that your original event and all similar events have been tagged

Set the precedence for an auto-tagging rule

Once an auto-tagging rule is created, you can assign it a Precedence value. If the auto-tagging rule has been configured to run on future events, the rule's precedence determines the order in which all auto-tagging rules are applied to incoming events. For example, you can have a rule with a precedence value of "1" that tags all "User Signed In" events as "suspicious", and a rule with a precedence value of "2" that removes the "suspicious" tag from all "User Signed In" events where the target (user) is you. This will result in a "suspicious" tag being applied to all future "User Signed In" events where the user is not you.

1. In an events list, click Auto-Tagging to display a list of saved auto-tagging rules.
2. Right-click an auto-tagging rule and select Details.
3. In the General tab, select a Precedence for the rule.

Auto-tagging log inspection events

Log inspection events are auto-tagged based upon their grouping in the log file structure. This simplifies and automates the processing of log inspection events within Deep Security Manager. You can use auto-tagging to automatically apply tags for the log inspection groups. Log inspection rules have groups associated with them in the rules. For example:

<rule id="18126" level="3">
<if_sid>18101</if_sid>
<id>^20158</id>
<description>Remote access login success</description>
<group>authentication_success,</group>
</rule>

<rule id="18127" level="8">
<if_sid>18104</if_sid>
<id>^646|^647</id>
<description>Computer account changed/deleted</description>
<group>account_changed,</group>
</rule>

Each group name has a "friendly" name string associated with it. In the above example, "authentication_success" would be "Authentication Success", "account_changed" would be "Account Changed". When this checkbox is set, the friendly names are automatically added as a tag for that event. If multiple rules trigger, multiple tags will be attached to the event.

Trusted source tagging

The integrity monitoring module allows you to monitor system components and associated attributes on a computer for changes. ("Changes" include creation and deletion as well as edits.) Among the components that you can monitor for changes are files, directories, groups, installed software, listening port numbers, processes, registry keys, and so on.

Trusted source event tagging is designed to reduce the number of events that need to be analyzed by automatically identifying events associated with authorized changes.

In addition to auto-tagging similar events, the integrity monitoring module allows you to tag events based on their similarity to events and data found on Trusted Sources. A trusted source can be either:

1. A local trusted computer,
2. The Trend Micro Certified Safe Software Service, or
3. A trusted common baseline, which is a set of file states collected from a group of computers.

Local trusted computer

A trusted computer is a computer that will be used as a "model" computer that you know will only generate benign or harmless events. A "target" computer is a computer that you are monitoring for unauthorized or unexpected changes. The auto-tagging rule examines events on target computers and compares them to events from the trusted computer. If any events match, they are tagged with the tag defined in the auto-tagging rule.

You can establish auto-tagging rules that compare events on protected computers to events on a trusted computer. For example, a planned rollout of a patch can be applied to the trusted computer. The events associated with the application of the patch can be tagged as "Patch X". Similar events raised on other systems can be auto-tagged and identified as acceptable changes and filtered out to reduce the number of events that need to be evaluated.

How does Deep Security determine whether an event on a target computer matches an event on a trusted source computer?

Integrity monitoring events contain information about transitions from one state to another. In other words, events contain before and after information. When comparing events, the auto-tagging engine will look for matching before and after states; if the two events share the same before and after states, the events are judged to be a match and a tag is applied to the second event. This also applies to creation and deletion events.

Tag events based on a local trusted computer

1. Make sure the trusted computer is free of malware by running a full anti-malware scan.
2. Make sure the computer(s) on which you want to auto-tag events are running the same (or some of the same) integrity monitoring rules as the trusted source computer.
3. In Deep Security Manager, go to Events & Reports > Integrity Monitoring Events and click Auto-Tagging in the toolbar.
4. In the Auto-Tag Rules (Integrity Monitoring Events) window, click New Trusted Source to display the Tag Wizard.
5. Select Local Trusted Computer and click Next.
6. From the list, select the computer that will be the trusted source and click Next.
7. Specify one or more tags to apply to events on target computers when they match events on this trusted source computer. Click Next.
   You can enter the text for a new tag or select from a list of existing tags.
8. Identify the target computers whose events will be matched to those of the trusted source. Click Next.
9. Optionally, give the rule a name and click Finish.

Tag events based on the Trend Micro Certified Safe Software Service

The Certified Safe Software Service is an allow list of known-good file signatures maintained by Trend Micro. This type of trusted source tagging will monitor target computers for file-related integrity monitoring events. When an event has been recorded, the file's signature (after the change) is compared to Trend Micro's list of known good file signatures. If a match is found, the event is tagged.

1. In Deep Security Manager, go to Events & Reports > Integrity Monitoring Events and click Auto-Tagging in the toolbar.
2. In the Auto-Tag Rules (Integrity Monitoring Events) window, click New Trusted Source to display the Tag Wizard.
3. Select Certified Safe Software Service and click Next.
4. Specify one or more tags to apply to events on target computers when they match the Certified Safe Software Service. Click Next.
5. Identify the target computers whose events will be matched to the Certified Safe Software Service. Click Next.
6. Optionally, give the rule a name and click Finish.

Tag events based on a trusted common baseline

The trusted common baseline method compares events within a group of computers. A group of computers is identified and a common baseline is generated based on the files and system states targeted by the integrity monitoring rules in effect on the computers in the group. When an integrity monitoring event occurs on a computer within the group, the signature of the file after the change is compared to the common baseline. If the file's new signature has a match elsewhere in the common baseline, a tag is applied to the event. In trusted computer method, the before and after states of an integrity monitoring event are compared, but in the trusted common baseline method, only the after state is compared.

1. Make sure all the computers that will be in the group that will make up the trusted common baseline are free of malware by running a full anti-malware scan on them.
2. In Deep Security Manager, go to Events & Reports > Integrity Monitoring Events and click Auto-Tagging in the toolbar.
3. In the Auto-Tag Rules (Integrity Monitoring Events) window, click New Trusted Source to display the Tag Wizard.
4. Select Trusted Common Baseline and click Next.
5. Specify one or more tags to apply to events when they have a match in the trusted common baseline and click Next.
6. Identify the computers to include in the group used to generate the trusted common baseline. Click Next.
7. Optionally, give this rule a name and click Finish.

Delete a tag

1. In an events list, right-click the events with the tag you want to delete, and select Remove Tag(s).
2. Select the tag you'd like to remove. Choose to remove the tag from The Selected [Event Type] Event or to Apply to selected similar [Event Type] Events. Click Next.
3. Enter some optional comments and click Finish.