In order to provide insightful Security Analytics and Monitoring, MOREAL backend engines prepare a set of metrics which are then presented in dashboards and IP profiles. They are also utilized by ThreatIQ components in order to extract significant conclusions on the behavior of monitored entities.

Currently, only syslog-based metrics are computed. Metrics and analytics for Netflow data are planned for inclusion in the next versions.

Terminology

• Entity: A monitored object or group of objects in the monitored network. For example a network/security device or a specific IP address.
• Attribute: A variable (usually categorical) that dinguishes events from each other. For example, the direction of traffic or the protocol used in a network connection.
• Metric : A (usually numerical) aggregate quantity which quantifies the behavior of a particular dimension (attribute) of an entity, in a given time period.

Measured events

• connections : (count) The number of network connections as measured by counting closing syslog traffic events for a given entity
• firewall blocks : (count) The number of firewall blocks as measured by counting denied syslog traffic events for a given entity
• threats (count) : The number of threat events in the corresponding logs from security devices.
• logins (count) : The number of login attempts at a network/security device
• failed logins (count) : The number of failed login attemps at a network security device
• access-control events (count) : The number of total events in access-control logs
• blocked access-control events (count) : The number of denied application-level events as reported in access-control logs
• emails (count) : The number of emails as reported in email logs (only selected devices)
• spam (count) : The number of spam emails as reported in email logs (only selected devices)
• VPN requests (count) : The number of vpn connection attempts (only selected devices)
• failed VPN requests (count) : The number of failed vpn connection attempts (only selected devices)
• services (unique count) : The number of unique services, as translated from IANA-registered destination ports
• threat IDs (unique count) : The number of unique threat IDs in reported events from security devices
• countries (unique count) : The number of unique countries a given entity communicates with (from GeoIP translation)
• AS numbers (unique count) : The number of unique Autonomous Systems a given entity communicates with
• External IPs (unique count) : The number of unique external IPs a given entity communicates with

Full Table of metrics

Here is the full table of metrics which are measured for incoming, outgoing and internal traffic. An extra category, named “unknown” is also reported when the direction of traffic cannot be determined by the available information.