Sizing and Scoping your QRadar SIEM. Adam Frank Chief Client Success Architect. Robert McGinley SWAT Security Intelligence Architect

Transcription

1 Sizing and Scoping your QRadar SIEM Adam Frank Chief Client Success Architect Robert McGinley SWAT Security Intelligence Architect

2 Please note IBM s statements regarding its plans, directions, and intent are subject to change or withdrawal without notice and at IBM s sole discretion. Information regarding potential future products is intended to outline our general product direction and it should not be relied on in making a purchasing decision. The information mentioned regarding potential future products is not a commitment, promise, or legal obligation to deliver any material, code or functionality. Information about potential future products may not be incorporated into any contract. The development, release, and timing of any future features or functionality described for our products remains at our sole discretion. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user s job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. 2

3 Notices and disclaimers 2018 International Business Machines Corporation. No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. This document is distributed as is without any warranty, either express or implied. In no event, shall IBM be liable for any damage arising from the use of this information, including but not limited to, loss of data, business interruption, loss of profit or loss of opportunity. IBM products and services are warranted per the terms and conditions of the agreements under which they are provided. IBM products are manufactured from new parts or new and used parts. In some cases, a product may not be new and may have been previously installed. Regardless, our warranty terms apply. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer follows any law. Think 2018 / March 21, 2018 / 2018 IBM Corporation 3

4 Notices and disclaimers continued Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products about this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM s products. IBM expressly disclaims all warranties, expressed or implied, including but not limited to, the implied warranties of merchantability and fitness for a purpose. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. IBM, the IBM logo, ibm.com and [names of other referenced IBM products and services used in the presentation] are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at: 4

5 Introduction to QRadar Deployment Sizing It is important to have your QRadar deployment sized properly to avoid the following conditions Performance Problems Inability to satisfy compliance requirements Limits security posture and limits threat detection Failure to capture critical security data Text or image Text or image Lorem ipsum dolor sit amet, consectetur adipiscing elit. 5

6 Introduction to QRadar Deployment Sizing Analogy Time Imagine the QRadar Platform as a bucket Volume How wide does the bucket need to be? How may hoses are filling the bucket at once? How much overall do we need to hold? Retention How deep must the bucket it go? How long must we keep the contents? 6

7 Introduction to QRadar Deployment Sizing Analogy Time (Cont.) How many buckets do you need? Will a few big buckets do the trick? Or many distributed buckets? Where do we need to keep the buckets? Data privacy, GDPR, etc. 7

8 Choose your QRadar Features What would your like your QRadar to do? QVRM QRadar Vulnerability & Risk Manager Requires additional hardware appliances Optional additional vulnerability scanner appliances QNI & Flows Requires additional hardware appliances for QNI, Flow Collection May require additional Flow Processors QRadar Apps AppNode should be considered for environments utilizing UBA and/or multiple QRadar apps AppNode required for UBA Machine Learning plugin QRadar Incident Forensics Requires additional hardware Requires PCAP collection appliance 8

9 QRadar Deployment Must Gathers What do you need to collect? Where do you need to collect it? How much do you need to collect? How long do we need to keep it? Event Sources Geography EPS Days? AD, Proxy, A/V, IPS DMZ FPM Weeks? Flow Collection Points Crown Jewels Months? Years? 9

10 QRadar Deployment Must Gathers Where must your data reside? Data Privacy GDPR CSL What is your bandwidth availability? Remote sites Mobile collection Network latency How many users? Concurrent searches What is your backup strategy? SAN/Attached Storage NFS Full-blown DR 10

11 Estimate your EPS and FPM POC of environment Log samples from your environment Estimator from sales team Average Event Size is around 750 bytes May not be representative of your environment Estimating average event size for YOUR environment is important QFlow captures the first 64 bytes of the payload Estimator from internets Logcaliper Estimation Tool Manual estimation Understanding the accuracy of your estimation is critical to correct sizing for current needs and future growth Gathering a sample of all your planned log sources for a specified period and averaging them can be very accurate Logcaliper itunes AppStore

12 Estimate Your EPS and FPM Additional Resources Developerworks Event FAQ 2/1775/ IBM Event & Storage Calculator (QRadar 7.2.7) content/uploads/sites/89/2017/08/qradar- 727-storage-calculator-v xlsx_.zip SANS Benchmarking Security Information Event Management (SIEM) Whitepaper 12

13 QRadar Console 31xx CPU & Memory heavy role Can be virtualized, but VM costs may be prohibitive Core component of QRadar Event Collector 15xx CPU & network heavy role Can be virtualized Collects and receives event data, buffers and forwards to Event Processor Must be paired with event processor Event/Flow Processor 16xx/17xx Disk & CPU heavy role Parses & normalizes incoming event/flow data Stores normalized event/flow data to respond to searches Data Node 14xx Disk & CPU heavy role Stores Event/Flow data Provides not only additional event/flow storage but additional search threads Not JBOD J Scales without effort, need more search or storage? More Data Nodes! 13

14 QRadar Console 31xx xx48 xx29 xx05 xx99 ~13TB SSD event/flow storage 128Gb RAM 48TB Raid 6 HDD event/flow storage 128gb RAM 5.6 TB Raid 6 HDD event/flow storage 64Gb RAM Virtual Depends 2x 8Gb FC 15,000 EPS (as AIO) 5,000 EPS (as AIO) 30,000 EPS (as AIO) 300,000 FPM (as AIO) 200,000 FPM (as AIO) 1,000,000 FPM (as AIO) 14

15 Event Processors 16xx xx48 xx29 xx05 xx99 ~13TB SSD event/flow storage 58TB Raid 6 HDD event/flow storage 5.6 TB Raid 6 HDD event/flow storage Virtual 128Gb RAM 128gb RAM 64Gb RAM 2x 8Gb FC 40,000 EPS 20,000 EPS 80,000 EPS 15

16 Flow Processors 17xx xx48 xx29 xx05 xx99 ~13TB SSD flow storage 128Gb RAM 2x 8Gb FC 80,000 EPS 58TB Raid 6 HDD flow storage 128gb RAM 40,000 EPS 5.6 TB Raid 6 HDD flow storage 64Gb RAM 20,000 EPS Virtual Depends 16

17 Data Node 14xx xx48 xx29 xx05 xx99 ~13TB SSD event/flow storage 128Gb RAM 58TB Raid 6 HDD event/flow storage 128gb RAM 5.6 TB Raid 6 HDD event/flow storage 64Gb RAM Virtual Depends 2x 8Gb FC 17

18 Choose your hardware Pick your console 3148 (SDD), 3129 (HDD), 3105 (HDD) When selecting SSD or traditional magnetic disks note the speed versus capacity tradeoff. Which is most important to you? Do you need Processors? If you need EPS/FPM Processing Do you need additional storage (Retention)? Disk space calculator Pair Up with Data Nodes Consider growth in sizing your QRadar deployment Ex. You currently have 10 devices you plan to integrate into QRadar however once deployed, any new projects/devices/deployments will likely impact your SIEM utilization. 18

19 Place your hardware Place your Event Collectors Plan your QNI Boxes Where they live HA appliances should be linked via crossover cable, preferably 10G Flow collectors should be strategically positioned for maximum value Near edge devices Ingress/egress points to DMZ or crown jewels How to handle SSL Where does our vulnerability information come from? QVM Integration 3 rd party scanners (Nessus, Qualys, etc.) One or more Event Collectors may be utilized in remote collection over slow WAN links For query performance, try to place Processor appliances close to the console You can place Processors at remote sites with highbandwidth connections back to the console 19

20 Common Deployment Patterns QRadar All In One A single appliance, QRadar All-in-One solution Event Collector and processor are on-board and utilize resources otherwise dedicated to the Console in a full distributed QRadar deployment 20

21 Common Deployment Patterns QRadar Full Deployment Represents a logical QRadar Deployment Architecture utilizing each major deployment role Event & Flow collectors receive incoming data, then pass to the appropriate processor for parsing & normalization Both Event & Flow Processors have an associated Data Node for additional search threads, CPU and storage capacity The QRadar Console is the focal point for this data 21

22 Common Deployment Patterns QRadar Events Only Specialized QRadar deployment for event collection and parsing only 22

23 Common Deployment Patterns QRadar on Cloud A cloud hosted QRadar console communicates with your on-prem QRadar Data Gateway via persistent VPN tunnel. Bandwidth availability is very important in this kind of deployment. 23

24 Other Considerations Additional factors that can affect your deployment High Availability Useful for Event Processors and Console HA Data Nodes are useful if expensive compared to a good backup solution Disaster Recovery Requires double the hardware QRadar configs replicated between Console environments Do you really need it? 24

25 Other Considerations Additional factors that can affect your deployment Appliance Disk Types Mixing HDD and SDD Processors and Data Nodes causes performance issues Load Balanced Event Collection Come special considerations required when writing rules Disable sticky session support QRadar on Cloud Place one or more on-prem data gateway appliances Hosted QRadar Console on VM or Bare Metal 25

26 Thank you Adam Frank Chief Client Success Architect Robert McGinley SWAT guy 26

27 27