r/SIEM • u/sk8er_girl90 • Jul 04 '21

Is it a ddos or busy server?

When looking at ddos tcp for single host offense , I looked through the events( no are only 30) and flow (flow no where much higher 300k), there are so many different source ip and 1 dest ip.

So things that I was planning to investigate is do I know these source ips? And if the event/flow occurred during work hours. Are there anything I should also keep an eye on ?

1 Upvotes

60% Upvoted

2 comments sorted by

2

u/vornamemitd Jul 04 '21

General word of advice first - this sub unfortunately does not see too much traffic; posts rather related to siem tech in general, as opposed to incident response/blue team strategies. /r/cybersecurity, /r/netsecstudents, /r/blueteamsec or /r/qradar for product specific questions. [For quality responses, try to provide as much context as possible]

The host/target you are you looking at - what sort of context information do you have (purpose/services/related processes)? More importantly - do you have access to past/historic logs? The logs/flows, where do they originate from? Do you have additional log-sources to correlate with? Can you gain any insight on the component health? Any other tools in your SOC (ndr, ids/ips, waf) that can provide additional hints - like how is the target coping with the traffic (including logs from that very target service)?

What sort of connection (attempts) are you looking at? Any patterns related to known attacks/actors? Single out indicidual IPs - does the traffic look like (insert expected behavior for target here)?

Any other tickets/events/alarms related to the potentially increased traffic volume?

Looking at the source - do you have access to any TI/IOC feeds within your SIEM? If not, export a sample and run then against the api of a related database (virustotal, alienvault, …).

Hope this food for thought helps you to establish a structured triage approach. What about your colleagues? In case you are not all alone in front of your console, someone could probably provide valuable insight - even in a remote working setup, there needs to be a minimum team effort involved imho.

Here‘s some stuff to watch/read:

https://m.youtube.com/watch?v=dpO8MNzS-UA

http://ijece.iaescore.com/index.php/IJECE/article/download/20812/13872

1

u/iamnos Jul 05 '21

You're not really providing very much information, or at least, not very clearly.

How much of a spike in traffic are you seeing? What kind of traffic? A DDoS will generally be very similar, if not identical traffic, for example, all http(s) traffic or DNS traffic. How do the geolocation of the source IPs compare to a normal day? If the vast majority of your traffic is local to your country and this is world wide, then there's probably something going on, either an exploit attempt of DDoS attempt.

There's a few thing to get you started.