Configure and Monitor Forensic Events
This chapter discusses how to configure and monitor forensic events within Cisco Secure Workload, providing insights into security incidents for thorough investigations.
The chapter explains the Forensic Event configuration details on setting up forensic events by selecting relevant tactics from the MITRE ATT&CK framework. This allows organizations to tailor their incident response strategies based on specific threat vectors. It highlights the importance of continuous monitoring for forensic events, enabling teams to detect and analyze suspicious activities promptly.
The chapter explains how to generate reports based on forensic data, therefore supports compliance audits and post-incident reviews. Configuring forensic events is vital for understanding attack patterns and improving future defenses.
|
When you enable the Forensics feature, the software agents may consume additional host resources based on the agent configuration. On Linux systems, the Linux audit system records audit events in the |
Regular monitoring and reporting facilitate a proactive approach to security management, ensuring organizations can swiftly adapt to emerging threats."
The Forensics feature set enables monitoring and alerting for possible security incidents by capturing real-time forensic events and applying user-defined rules:
-
Defining of rules to specify forensic events of interest
-
Defining trigger actions for matching forensic events
-
Searching for specific forensic events
-
Visualizing event-generating processes and their full lineages
|
|
Due to recent GUI updates, some of the images or screenshots used in the user guide may not fully reflect the current design of the product. We recommend using this guide in conjunction with the latest version of the software for the most accurate visual reference. |