ÓªÒµÅä¾°
Ëæ×ÅÒ½ÁÆÐÅÏ¢»¯µÄ¸ßËÙÉú³¤£¬Ò½ÁÆ»ú¹¹ÐÅϢϵͳµÄÖØƯºóÒ»Ö±Ìá¸ß£¬ÍøÂçµÄ¹æÄ£ÈÕÒæÔö´ó£¬ÖÖÖÖÍøÂç×°±¸¡¢Çå¾²×°±¸¡¢Ó¦ÓÃϵͳ²»µ«Æ·ÖֶಢÇÒÊýÄ¿´ó£¬ÍøÂçÄÚ²¿µÄÖն˼°·þÎñÆ÷ÊýÄ¿ÉÙÔòÊýʮ̨¶àÔòÉÏÍǫ̀¡£Ëæ×Å¡¶ÖлªÈËÃñ¹²ºÍ¹úÍøÂçÇå¾²·¨¡·ºÍÆ·¼¶ÑÚ»¤Ïà¹ØÕþ²ßÐû²¼¼°ÒªÇ󣬸÷Ò½ÁÆ»ú¹¹»ù±¾ÉÏÒѾÍê³ÉÁË×ÝÉîµÄÇå¾²·ÀÓùϵͳµÄ½¨É裬ÔÚ¸÷Ö÷¸ÉÁ´Â·É϶¼°²ÅÅÁË´ó×ÚµÄÍøÂçÇå¾²·À»¤ºÍÇå¾²Éó¼Æ²úÆ·£¬ºÃ±È·À»ðǽ¡¢WEBÓ¦Ó÷À»ðǽ¡¢ÈëÇÖ¼ì²â\·ÀÓù×°±¸¡¢Öն˼ì²âÓëÏìÓ¦¡¢×ÛºÏÉó¼Æ¡¢Êý¾Ý¿âÉó¼ÆµÈ¹Å°å²úÆ·£¬µ«ÕâЩ²úÆ·¶¼ÊÇ»ùÓÚµ¥µãµÄÊÂÇé»úÖÆ£¬Ò»Ö±Éú³¤µÄÍþв¼ì²âÊÖÒÕÒ²´øÀ´´ó×ÚÇå¾²¸æ¾¯¡£Çå¾²ÔËÓªÖ°Ô±ÔÚ¶ÔÇå¾²ÊÂÎñ´¦Öóͷ£Ê±£¬ÐèÒªÔÚÖÖÖÖÇå¾²×°±¸ÉÏÍù·µ²Ù×÷¡£Óɴ˿ɼû£¬¸÷Çå¾²×°±¸Ö®¼äµÄÕûºÏ¶ÈµÍ¡¢Áª¶¯ÐÔ²»Ç¿£¬ÔÚÓ¦¶ÔÍøÂçÇå¾²ÊÂÎñʱ²»¿É¸ßЧÐͬ¡£
Ä¿½ñÖÖÖÖ¹¥»÷×éÖ¯¶ÔÎÒ¹úÒ½ÁÆÐÐÒµ¾ÙÐÐÁË´ó¹æÄ£Ò»Á¬ÐÔÍøÂç¹¥»÷£¬¸÷Ò½ÁÆ»ú¹¹ÃæÁÙµÄÍøÂçÇå¾²ÍþвÐÎÊÆÈÕÒæÑÏËà¡£Ò»Á¬ÐԵĸ߼¶Çå¾²ÍþвԽÀ´Ô½ÆµÈÔ£¬Ò½ÁÆÊý¾ÝйÃܺͻ¼ÕßÐÅϢ鶵ÈÊÂÎñ³£Óб¬·¢£¬Ò½ÁÆ»ú¹¹ÔõÑù¿ìËÙ·¢Ã÷Êý¾ÝйÃÜÊÂÎñ£¬²¢½ÓÄÉÆ𾢵ķÀÓùÊÖ¶Îʵʱ×èÖ¹ÊÂÎñµÄ±¬·¢£¬ÒѳÉΪÇå¾²ºÏ¹æÐÔÐèÇó¡£ÃæÁÙÊýÄ¿ÖØ´óÇÒÓúÒæÒþ²ØºÍÒ»Á¬µÄÇå¾²Íþв£¬Ò½ÁÆ»ú¹¹´ó²¿·ÖÇå¾²²Ù×÷ÈÔÈ»ÊÇÓÉÔËÓªÍŶÓÒÀ¾ÝÎĵµºÍ³ÌÐò»¯µÄÁ÷³ÌÊÖ¶¯Î¬»¤£¬Õâ¸øÇå¾²ÔËÓª´øÀ´ÁËÖØ´óµÄÌôÕ½¡£Ò»·½Ã棬ÍøÂçÇ徲רҵÈ˲ŵÄǷȱ£¬Ê¹µÃÒ½ÁÆ»ú¹¹ÄÑÒÔÓ¦¶ÔÊýÄ¿¼¤ÔöµÄÍøÂçÇå¾²ÊÂÎñ£¬Çå¾²ÆÊÎöʦÌìÌìÊÕµ½µÄ¸æ¾¯ÍùÍù¶¼ÊÇÊýÒ԰ټƣ¬Ô¶Ô¶Áè¼ÝËûÃÇÏÖʵ¿ÉÒÔ´¦Öóͷ£µÄ¸æ¾¯ÊýÄ¿¡£ÁíÒ»·½Ã棬Çå¾²ÆÊÎöʦÔÚÇå¾²ÊÂÎñ´¦Öóͷ£ÉϵÄÂÄÀúÄÑÒԹ̻¯£¬Çå¾²ÆÊÎöʦËù¾ß±¸µÄÄÜÁ¦ÊÇÒÀÀµ´¦Öóͷ£´ó×ÚÇå¾²ÊÂÎñºóÆä×ܽáÂÄÀúÐγɵģ¬ÆÊÎöʦµÄÂÄÀú²»¿Éµü´ú¹Ì»¯£¬¾ÍÒâζ×Å×÷ÓýÒ»Ãû¼°¸ñµÄÇå¾²ÆÊÎöʦ¶¼ÐèÒªºã¾ÃµÄÂÄÀú»ýÀÛ£¬Õ⽫ÑÓ»ºÕû¸öÇ徲ϵͳÈ˲Ž¨ÉèµÄ³ÌÐò£¬Ò²Ê¹µÃÇ徲רҵְԱµÄ±¾Ç®¸ß¾Ó²»Ï¡£
Çå¾²ÐèÇó
1£©Ç徲רҵְԱǷȱ£ºÓÉÓÚÇ徲רҵְԱǷȱ£¬¿Í»§ÌåÏÖÔ½À´Ô½ÐèÒª×Ô¶¯»¯µÄ»úÖÆе÷¸÷Ïî¿ÉÖظ´µÄÇ徲ʹÃü£¬´Ó¶øÐγÉÔËÓª¹æÄ£¡£
2£©Ó¦¶ÔÒ»Ö±ÑݱäºÍ¾çÔöµÄÇå¾²Íþв£ºµ±×é֯˼Á¿ÆÆËðÊý¾Ý²¢¿ÉÄܵ¼ÖÂ֪ʶ²úȨй¶ºÍÀÕË÷ڲƵÈÍþвʱ£¬ÍùÍùÐèÒª¿ìËÙ¡¢Ò»ÖºÍÖ»¹ÜÒÔ¸üÉÙµÄÊÖ¶¯°ì·¨ÆµÈÔÏìÓ¦¡£
3£©Ìá¸ß¸æ¾¯µÄÕï¶ÏËÙÂʺÍÖÊÁ¿£ºÖÚËùÖÜÖª£¬Çå¾²¼à²âϵͳ£¨ÈçSOC/SIEMµÈ£©ÔËÐб¬·¢µÄ´ó×ڸ澯£¬°üÀ¨Ðí¶à·¢Ã÷Ϊ¡°Î󱨡±»òʺó»ù´¡²»Ïà¹Ø¸æ¾¯µÄÌØÊâÊӲ죬¶ÔÕâЩ¸æ¾¯µÄ´¦Öóͷ£ÐèÒªÏûºÄ´ó×Ú±¾Ç®£¬Ï£Íûͨ¹ý¿ÉÖظ´ºÍ¸ßƵ´ÎµÄ×Ô¶¯»¯ÊÂÎñÊӲ죬×ÊÖúÌá¸ßÐÅÔë±È¡£
4£©Ëõ¶ÌÏìÓ¦¡¢×èÖ¹ºÍµ÷½âµÄʱ¼ä£ºÒ½ÁÆ»ú¹¹ÕýÔÚ´¦Öóͷ£ÈÕÒæÖØ´óµÄÇå¾²Íþв£¬ÀýÈçÀÕË÷ڲƲ¡¶¾£¬ÎªÁË×èÖ¹ÆäÔÚÇéÐÎÖкáÏòÈö²¥£¬ÔËÓªÍŶÓÍùÍùÖ»Óм¸·ÖÖӵĿìËÙÏìӦʱ¼ä£¬ÐèÒªÔÚÇå¾²·À»¤ÏµÍ³ÉÏÏ·¢Í³Ò»µÄ·À»¤Õ½ÂÔ£¬²Å»ªÓÐʱ»ú¶Ìʱ¼äÄÚ×èÖ¹Íþв¡£
5£©ïÔÌÇå¾²ÆÊÎöʦ²»ÐëÒªµÄÒ»Ñùƽ³£ÊÂÇ飺Çå¾²ÔËÓªÖÐÐĵÄÇå¾²ÆÊÎöʦÔÚ¾ÙÐÐÊÂÎñÆÊÎöºÍÊÓ²ìʱ£¬¾³£¶àÖÖ¹¤¾ßÅäÌ×ʹÓã¬ÍùÍùÐèÒªÔÚ²î±ðµÄ¹¤¾ßÉÏÍù·µ²Ù×÷¡£ºÃ±ÈËûÃÇÐèҪƾ֤SOC/SIEM ¿ØÖÆ̨¸æ¾¯£¬ÔÚÍþвÇ鱨ƽ̨ÉÏ»ñÈ¡Ïà¹ØʵÌåµÄÐÅÏ¢£¬ÔÚÖն˼ì²âºÍÏìÓ¦ £¨EDR£©ÉÏ»ñÈ¡ÓйØÊÜÓ°ÏìµÄÖÕ¶ËÉÏÏÂÎÄÐÅÏ¢£¬ÐèҪͳһµÄÇå¾²ÊÂÎñÊÓ²ìÆÊÎöÓë´¦Öóͷ£Æ½Ì¨½«ÕâЩ¹¤¾ßÅþÁ¬ÔÚÒ»Æð¾ÙÐÐÇå¾²ÊÂÎñµÄÐͬ´¦Öóͷ£¡£
½â¾ö¼Æ»®
GartnerÔÚ2015ÄêÊ×´ÎÌá³öSOAR¿´·¨£¬½« SOAR ½ç˵Ϊ Security Operations, Analytics, and Reporting£¨Çå¾²ÔËάÆÊÎöÓ뱨¸æ£©¡£µ½ÁË 2017 Ä꣬Gartner ÖØн« SOAR ½ç˵ΪÇå¾²±àÅÅ×Ô¶¯»¯ÓëÏìÓ¦£¨Security Orchestration, Automation and Response£©£¬²¢½«Æä¿´×÷ÊÇÇå¾²±àÅÅÓë×Ô¶¯»¯ (SOA£¬ Security Orchestration and Automation)¡¢Çå¾²ÊÂÎñÏìӦƽ̨ (SIRP, Security Incident Response Platform) ºÍÍþвÇ鱨ƽ̨ (TIP, Threat Intelligence Platform) ÈýÖÖÊÖÒÕ/¹¤¾ßµÄÈںϡ£2019ÄêºóSOARµÄÉú³¤Â·¾¶½«ÓÉSOCÓÅ»¯¡¢Íþв¼ì²âºÍÏìÓ¦¡¢ÍþвÊÓ²ìºÍá÷ÁÔÒÔ¼°ÍþвÇ鱨ÖÎÀíÀ´Çý¶¯¡£Î´À´£¬SOAR ÊÖÒÕÈÔÈ»ÔÚ¿ìËÙÑÝ»¯£¬ÄÚÔÚδÀ´ÈÔ¿ÉÄÜ»áת±ä£¬µ«ÆäÌáÉýÇå¾²ÔËӪЧÂÊ£¬¼ÓËÙÇå¾²ÏìÓ¦ËÙÂʵÄÄ¿µÄ²»»á¸Ä±ä¡£
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÌ©ºÏÖÇÄÜÔËӪϵͳ£¨TSOC-IOS£©Ö¼ÔÚ×ÊÖúÇå¾²ÔËÓªÍŶӺÍÇå¾²ÆÊÎöʦ´ÓÖظ´¡¢¼òÆÓ¡¢ËÀ°åµÄÒ»Ñùƽ³£ÊÂÇéÖнâÍѳöÀ´£¬²¢ïÔÌÓÉÓÚÈ˹¤Îó²Ù×÷ÒýÆðµÄ²»ÐëÒªµÄʹʣ¬ÌáÉýÍøÂçÔËά¡¢Çå¾²ÆÊÎöºÍÓ¦¼±ÏìÓ¦ÄÜÁ¦¡£
¸ÃϵͳʹÓÃÇå¾²±àÅÅÓë×Ô¶¯»¯ÏìÓ¦£¨SOAR£©ÊÖÒÕ£¬Í¨¹ýÊý×Ö»¯µÄÊÂÇéÁ÷½ç˵ÊÂÎñÆÊÎöºÍÏìÓ¦Àú³Ì£¬Çå¾²ÔËÓªÖ°Ô±¿Éƾ֤±ê×¼»¯µÄÊÂÎñÏìÓ¦Á÷³Ì£¬ÊµÏÖ×Ô¶¯»¯µÄ¾ÙÐÐÊÂÎñÆÊÎöºÍÓÅÏȼ¶ÅÅÐò£¬×ÊÖúÆóÒµºÍ×éÖ¯ÔÚÃæÁÙÍþвʱÌṩչÍû¡¢·ÀÓù¡¢¼ì²âºÍÏìÓ¦ÄÜÁ¦¡£¸Ãƽ̨ÈÚºÏÁËÇå¾²±àÅźÍ×Ô¶¯»¯£¨SOA£©¡¢Çå¾²ÊÂÎñÏìÓ¦£¨SIR£©ºÍÍþвÇ鱨£¨TI£©µÄÏà¹ØÀíÄîºÍÊÖÒÕ£¬²¢ÒýÈëÊý×Ö»¯ÊÂÇéÁ÷¡£ÏµÍ³ÒÔÄ¿µÄΪµ¼Ïò£¬½«Ò»Ñùƽ³£ÏêϸµÄ¸÷ÏîÇå¾²ÊÂÇéÄÚÈݹ̻¯ÎªÊÂÇéÁ÷ÉϵÄÒ»¸ö¸ö½Úµã£¬Í¨¹ý¶ÔÕâЩ½ÚµãµÄÓÐÐòÅÅÁÐ×éºÏ£¬±àÅÅΪijһÖØ´óÊÂÇéµÄÊÂÇéÁ÷³Ì£¬Ò²³ÆΪ¡°¾ç±¾¡±£¨»òPlaybooks£©¡£ÔÚÒ»Ñùƽ³£Çå¾²ÔËÓªÊÂÇéÖУ¬Õë¶ÔijÏîÏêϸÊÂÇ飬ÈôÊDZ£´æ±àÅźõľ籾£¬Ôò¿ÉÒÔÒÀ¾ÝÕâ¸ö¾ç±¾°´²¿¾Í°àµØÊÂÇ飬ͨ¹ý³ÌÐò¾ÙÐÐ×Ô¶¯»¯ÏìÓ¦Ò²±ã³ÉΪ¿ÉÄÜ¡£³ý´ËÖ®Í⣬TSOC-IOS»¹¾ßÓÐÔËÓª¼¨Ð§KPIÆÀ¹Àϵͳ£¬¿É¶ÔÓªÒµÊÂÇéÁ÷³ÌºÍ¾ç±¾×Ô¶¯»¯Ö´ÐеÄЧ¹û¾ÙÐÐÓÐÓõÄÆÀ¹À£¬ÒÔ±ã¾ÙÐÐÊÂÇéÁ÷³ÌµÄˢкͱàÅÅÄÚÈݵÄÓÅ»¯¡£
Ì©ºÏÖÇÄÜÔËӪϵͳTSOC-IOS¿É¾ÙÐÐÇå¾²ÊÂÎñµÄÍøÂ磬ÆÀ¹ÀÆäÑÏÖØÐÔ£¬Ðµ÷ÊÂÎñÏìÓ¦ºÍµ÷½â£¬²¢¼à²âÕû¸öÀú³Ì£¬¿ÉÒÔÊÂÎñ½â¾öÏìÓ¦Àú³ÌÖÐְԱǷȱ¡¢Ë¢Ð¸澯·ÖÀàÖÊÁ¿ºÍËÙÂÊ¡¢ïÔÌÊÂÎñÏìӦʱ¼ä¡¢Ìá¸ßÇå¾²ÔËÓªÍŶÓÕûÌåÊÂÇéЧÂʵÈÎÊÌâ¡£
Ì©ºÏÖÇÄÜÔËӪϵͳTSOC-IOSÌṩÇå¾²±àÅÅÓë×Ô¶¯»¯£¨SOA£©¡¢ Çå¾²ÊÂÎñÏìÓ¦£¨SIR£©ºÍÍþвÇ鱨ÖÎÀí£¨TIP£©Èý´ó½¹µãÄÜÁ¦£¬¿É×ÊÖúÒ½ÁÆ»ú¹¹µÄÇå¾²ÍŶÓÄܹ»ÍøÂç¼à¿ØÊý¾Ý£¬²¢Äܹ»ÊµÏÖ²¿·Ö×Ô¶¯»¯µØ¾ÙÐÐÊÂÎñÆÊÎöºÍ·ÖÀàÀú³Ì£¬Æ¾Ö¤Ô¤½ç˵µÄÊÂÇéÁ÷£¬È·¶¨ÓÅÏȼ¶²¢Íƶ¯±ê×¼»¯µÄÊÂÎñÏìÓ¦Ô˶¯¡£
¼Æ»®ÓÅÊÆ
¡ñ »ùÓÚÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÌ©ºÏ²úÆ·±¾²¿ÏȽøµÄCUPID¿ª·¢¿ò¼Ü£¬ÊµÏÖÇå¾²±àÅÅÓë×Ô¶¯»¯ÏìÓ¦µÄ¼Ü¹¹Éè¼Æ£¬Í¨¹ý¶ÔÇå¾²ÄÜÁ¦µÄ±àÅÅÓë×Ô¶¯»¯ÉèÖÃÏìÓ¦µÄϵͳ¿ò¼Ü¡¢¹¦Ð§×é³É¡¢½Ó¿Ú¹æ·¶µÄÑо¿£¬¿ÉÓëÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÌ©ºÏÐÅÏ¢Çå¾²ÔËÓªÖÐÐÄϵͳ£¨USM\SOC£©ÎÞ·ì¶Ô½Ó£¬ÊµÏÖϵͳµÄ×Ô¶¯»¯¡¢Çå¾²¿É¿¿µÄÖÇÄÜÔËÓª¡£
¡ñ ʵÏÖÇå¾²ÉèÖÃÒâͼ±íÕ÷ÊÖÒÕ£¬Ñо¿ÏµÍ³ÉèÖÃÓëÔËÓªµÄÒâͼÐÎòÓïÑÔ£¬Í¨¹ý¿ÉÊÓ»¯µÄ±à¼Æ÷£¬ÒÔÊÖ¹¤ÍÏקµÄ·½·¨ÊµÏÖÇå¾²·À»¤ÄÜÁ¦ºÍÈ˹¤È·ÈÏÏàÍŽᣬƾ֤һ¶¨µÄÂß¼¹Øϵ×éºÏµ½Ò»Æð£¬ÓÃÒÔÍê³Éij¸öÌض¨Çå¾²²Ù×÷µÄÀú³Ì£¬ÊµÏÖÇå¾²ÄÜÁ¦µÄ±àÅÅ¡£¾ß±¸¶ÔÍøÂç×°±¸¡¢Çå¾²×°±¸¡¢×°±¸µÈÉèÖÃÓëÖÎÀíÐÎòµÄÄÜÁ¦£¬¿ÉʵÏÖÈËÀàÒâͼת»»ÎªÏµÍ³ÉèÖõÄÒâͼÐÎòÓïÑÔ¡£
¡ñ Çå¾²ÉèÖÃ×Ô¶¯ÌìÉúÓëÑéÖ¤ÊÖÒÕ£ºÑо¿ÉèÖÃÕ½ÂÔÐÎòÓ볡¾°½¨Ä£¡¢ÉèÖÃÒâͼ×Ô¶¯»¯×ªÒëµÈÄÚÈÝ£¬ÊµÏÖϵͳÉèÖÃÕ½ÂÔ´ÓÊÖ¶¯µ½×Ô¶¯»¯ÌìÉú£¬Í¨¹ý¶ÔÇå¾²×°±¸»òϵͳµÄÇå¾²ÄÜÁ¦ÓëÏìÓ¦Ðж¯µÄÁýͳ´¦Öóͷ££¬ÆÁÕÏÁËÇå¾²ÔËÓªÖ°Ô±¶Ô×°±¸¾ÙÐÐÖ¸Á²Ù×÷£¬½µµÍÊÖ¹¤ÉèÖùýʧÂÊ¡£
¡ñ Çå¾²ÉèÖÃÐÒéÉè¼ÆÊÖÒÕ£ºÑо¿ÃæÏòÍøÂç×°±¸¡¢Çå¾²×°±¸µÈÇå¾²ÄÜÁ¦ÐèÇóÓë½Ó¿Ú¹æ·¶µÄÐÎò¡¢Á½ÕßÓ³Éä¹Øϵ½¨Ä£ÓëÑéÖ¤£¬ÊµÏÖϵͳװ±¸µÄ¶ÔÍâ½Ó¿Ú̻¶¸üСµÄÇ徲Σº¦£¬ÊµÏÖ¸ü¸ßµÄÇå¾²¡£¿ÉÖ§³ÖÍøÂç×°±¸¡¢Çå¾²×°±¸µÈ×°±¸µÄ½Ó¿Ú¡£
Copyright ? ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø °æȨËùÓÐ ¾©ICP±¸05032414ºÅ ¾©¹«Íø°²±¸11010802024551ºÅ