Detecting Network Change
Tenable has recently added several TASL correlation rules which detect a variety of network changes. These rules automatically detect:
- Changes to servers such as new software and added patches
- Changes to users such as adding/removing a user, changing their passwords and disabling their accounts
- Changes to network devices such as saving new configs of a router or switch
- Changes to the network such as new hosts being added
Here is a screen shot of what these look like under the Security Center:
These new TASLs also compliment the existing scripts which detect user account to host relationships and alerting when new Ethernet addresses are discovered in DHCP logs and logs from Tenable's Passive Vulnerability Scanner.
Related Articles
Four Questions to Minimize the Cyber Risk of Your Public-facing Assets and Web Apps
November 17, 2021Ask the following four questions to help reduce cyber risk in your public-facing assets and web apps.
Cybersecurity Pros Face Significant Challenges with OT Security: Ponemon Report
April 5, 201962% of organizations in industries relying on operational technology experienced two or more business-impacting cyberattacks in the past 24 months, according to a report from Ponemon Institute an...
Recap: Geeking Out II with Marcus
April 15, 2013Ron and I spent most of the webcast rotating around the theme of detection algorithms: how do you determine what is normal and what is not? We started off with one of my favorite questions, "Are there...
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
- Passive Network Monitoring