1. What are Threat Models?

Real time alerts are generated whenever a potential threat is detected by enabling one of many pre-defined Threat Models which are included within the Lepide Data Security Platform. A threat model is a predefined alert for a particular scenario, for example a potential ransomware attack, or files copied. Real time alerts are generated whenever a potential threat is detected by enabling one of these predefined Threat Models.

To display a list all the Threat Models available within the Lepide Data Security Platform, select Lepide Identify, Alert Configuration and the following screen will be displayed:

The Threat Models can be enabled as needed. They can then be configured to generate an alert and respond to a threat.

2. Responding to a Potential Attack

Once alerts have been received, automated scripts can be executed to speed up the response time and address any threats immediately. Using custom script execution, user accounts and/or file servers can be shut down and other actions taken to prevent malware from spreading.

With a detailed and complete audit trail of all changes being made to your data, permissions and systems, the Lepide Data Security Platform can provide your security operations team with the information they need to investigate incidents faster and more efficiently.

2.1 Improve Incident Response and Integrate with your SIEM

The Lepide Data Security Platform can integrate with any SIEM solution to simplify your ransomware response. The Solution can be configured to send specific events to your SIEM and give more context to the raw audit data.

3. How to Enable and Configure the Ransomware Attack Threat Model and Create an Alert

One example of a Threat Model is for a Ransomware Attack and the steps to enable and configure this are as follows:

• From the Web Console Home Page, select Detect

The Alert Configuration screen will be displayed:

• This screen shows all the available threat models. Scroll down and until you can see the Potential ransomware attack Threat Model

To enable and configure the Potential ransomware attack Threat Model, click the Edit icon

This will start the Alerts Wizard:

• Slide the Status button to the right to enable the alert

• Click Next

• On the lower section of the dialog box, you can see the report you are working on which in this case is Potential Ransomware Attack.

1.1 To Add a Filter

• Click the Add Filter

  

  button to add a filter if required. This will add filter options to the dialog box:

• Click the drop down next to the field options and select the required field:

• Click the drop-down arrow next to Include to select from the following options:

If an option other than All is selected, you can click the Add Filter button and specify the filter information

In the example below, Server and Selected Only have been chosen. By clicking the Add Filter

• Select a value from the list and click Done

• The threshold alert options can be customized as follows:

• Click Next

The Alert Settings dialog box is displayed:

This dialog box allows you to set up responses to occur when an alert has been triggered and displays any existing responses which have been set up.

You can also select the following:

Alert Type: alert types are Critical, Warning or Normal

Process alert remotely: check this box and select an Agent Server from the drop-down menu to use an agent for processing the alert

• To create a new response to an alert, click the Add Action button.

• The Alert Action dialog box will be displayed:

• Click the Select Action drop down arrow to see a list of actions available:

The Alert Actions are as follows:

• Send Email Alert

• Show in LiveFeed

• Send Alert to App

• Execute Script

• Send Alert to SIEM

The configuration of each of these actions is explained below:

Send Email Alert

This option allows you to send an email once an alert has been triggered. The elements of the dialog box are as follows:

Sender’s Email Account: The Sender’s email account will be displayed here if it has been selected. Click Add New Email Account to enter a new Sender’s Email Account. Further information on how to add a new email accounts is shown in Section 3.2.1 of this guide.

Recipient Email(s): Add recipient emails by typing the email addresses into the box. If there are multiple email addresses. separate them with a ‘,’

Send Actions for past xx days: This option allows you to see everything that this user has done over the last number of specified days. For example, if an alert is triggered because they have been copying files, then you may want to see what else they have been doing. Check this box and specify the number of days and an email will be sent with an attachment listing everything that the user has done over the specified number of days.
The attachment will contain a report and the format(s) can be specified by checking the relevant box. The formats are CSV, MHT and PDF.

Send Email to user: Check this box to send an email to the user. The content of the email can be typed into the text box. To include the username within the content, use the variable %USERNAME%. Note that this option is only applicable to File Server alerts.

• Click Done to save the alert action.

1.1.1 Add New Email Account

• Select Add Email Account from the menu

The following dialog box is displayed:

• Add the following information:

  • Check the Multi-Factor Authentication box if required

  • Display Name

  • Sender’s Email Id

  • Check the Requires authentication box if required

  • Logon Name

  • Password

  • Server Name/IP

  • Port

  • Check the Requires a secure connection (SSL) if required

• Select Send test mail to check that all the settings have been added correctly

• Click Done when finished

• You will return to the Alert Action dialog box

• Select the Sender Email Account

• Click Done when finished

Show in LiveFeed

Show in LiveFeed means that the alert will be sent to the Lepide dashboard.

• Click OK to switch the LiveFeed alert on.

Send Alert to App

The Send Alert to App option sends the alert to a mobile device.

1.1.2 Add an App Account

• Click the Add App Account button to add a new mobile account. The following dialog box is displayed:

• Enter the User ID and Password

• Enter the Mobile App ID which is generated by using the mobile device to scan the QR code displayed at the bottom of the dialog box.

• Click Done when you have finished adding the account. You will return to the Configure Report Delivery Action screen

• Select the newly added account from the list

• Click Done when finished

• Execute Script

Execute Script gives the option to execute one of the predefined PowerShell scripts when an alert is triggered.

The elements of the dialog box are as follows:

• File Path: Browse to choose the file path of the PowerShell script by clicking

  

• Choose either:

  • Run with SYSTEM account or

  • Run with selected account.

If you choose Run with selected account, you can use the drop-down to select the account or click Add Account to specify the account to be used.

• Choose Notify me when a script is executed to send an email on script execution.

When this option is checked, the Configure button becomes available. Choose Configure to set up the sender’s account and recipient’s email address.

• Choose Parameterized input file contains to specify a variable to include in the script. When this option is checked, a drop-down menu becomes available to choose a variable:

• Click Test Script to test that the specified script runs with no errors.

Send Alert to SIEM

• The Send Alert to SIEM option allows you to add a SIEM account and send an alert to the SIEM

1.1.3 Add a SIEM Account:

• Click the Add SIEM Account button to add details of your SIEM account

The following dialog box is displayed:

• Add the Name, IP Address and Port Number for the SIEM account

• Check the CEF Format box if required

• Click Submit

This will take you back to the Configure Report Delivery Action screen.

• Select the SIEM account and click Done when finished

• Click Done to return to Add Alert dialog box and details of the alert will be displayed

• Click Done when finished and the alert will be created

• Click Done when finished to return to the Alert Configuration screen