The AlienVault Generic Data Source is a predefined view of events which displays log data when the USM Anywhere SensorSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation. is unable to match them with any AlienApps based on hints and manual associations.
This view works the same as the events list view. On the left you can find the search and filter options. In the upper side of the page, you can see any filters you have applied, and you have the option to create and select different views of the events. The main part of the page is the actual list of events. Each row describes an individual event.
If you want to analyze the data
The following table lists the fields you see on the page.
|Column / Field Name||Description|
|Event Name||Name of the event.|
|Time Created||The date and time of the creation of the event. The displayed date depends on your computer's time zone.|
|OTX||Indicate if it is an OTXThe world’s first truly open threat intelligence community. Enables collaborative defense with open access, collaborative research, and seamless integration with USM Anywhere and USM Appliance, and AlienApps for other security products. event or not. If the icon displays as active, click it to go to OTX.|
|Reporting Device||The asset that sent the syslogAn industry standard message logging system that is used on many devices and platforms..|
Hostname or IP address of the hostReference to a computer on a network. (with the national flag if the country is known) that initiates the event.
Important: If you want to create a rule, instead of using this field, use the Source Name or Source Asset ID fields.
Hostname or IP address of the host (with the national flag if the country is known) that receives the event.
Important: If you want to create a rule, instead of using this field, use the Destination Name or Destination Asset ID fields.
Name of the USM Anywhere Sensor detecting the event. The type of sensor is also displayed below the sensor name.
|Username||Username associated with the event.|
The Reporting Device column includes the assets that sent the syslog. Next to the asset name of this column,
- Assign plugin: See Adding AlienApps to an Asset for more information.
- Full Details: See Viewing Assets Details for more information.
- Configure Asset: See Editing Assets for more information.
- Delete Asset: See Deleting the Assets for more information.
- Assign Credentials: See Managing Credentials in USM Anywhere for more information.
- Authenticated Scan:Authenticated scans are performed from inside the machine using a user account with appropriate privileges. This option displays depending on the USM Anywhere Sensor associated with the asset. See Running Authenticated Asset Scans for more information.
- Scan with AlienApp: This option enables you to run an asset scan through an AlienApp. See Running Asset Scans Using an AlienApp for more information.
- Run Scan: This option displays depending on the USM Anywhere Sensor associated with the asset. See Running Asset Scans for more information.
- Configuration Issues:An identified configuration of deployed software or features of software that is in use, which is known to be insecure. This option opens the Asset
sDetails page. The Configuration Issues tab is selected in the page. See Viewing Assets Details for more information.
- Vulnerabilities: This option opens the Asset
sDetails page. The Vulnerabilities tab is selected in the page. See Viewing Assets Details for more information.
- Alarms: This option opens the Asset
sDetails page. The Alarms tab is selected in the page. See Viewing Assets Details for more information.
- Events:Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall. This option opens the Asset
sDetails page. The Events tab is selected in the page. See Viewing Assets Details for more information.
Next to the source and destination asset name, click the icon to access these options:
- Add to current filter: Use this option to add the asset name as a search filter. See Searching Events.
- Look up in OTX: This option searches the IP address of the source asset in the Open Threat Exchange page. See Using OTX in USM Anywhere
- Add asset to system: Use this option to create the asset in the system. See Adding Assets.
You can configure the view you want for the list of events; see Views for more information.
Click Generate Report to open the Configure Report dialog box. See Create an Events Report for more details.
The graph above the events list displays the amount of events in a period of time. You can change this period by clicking Last 24 Hours filter.
Click the icon to access these options:
- Actions / User: Reports USM Anywhere account activity based on specific account users and summarized by Create, Read, Update, and Delete categories.
- Count / Time: Provides Reports USM Anywhere account activity based on specific account users and summarized by Create, Read, Update, and Delete categories.
- Auth / User: Reports authorization actions.
- Source Map: Provides the number of events associated with each country on a global map.
Click the icon to bookmark an item for quick access.
Click the icon to filter your search by row fields. See Filtering Events by Row Fields for more information.
You can choose the number of items to display by selecting 20, 50, or 100 below the table.
Within the page, you can configure the columns and fields that display in the List view. You can also save your columns configuration to return to it whenever you need it.
To configure your columns
AlienVault Generic Data Sourcelist view, click the icon.
ManageColumns dialog box opens.
Search the columns you want to have in the list view. You can enter your search in the search field.
Use the and icons to pass the items from one column to the other and select the columns you want to see.
You can order the columns by clicking one of them and dragging the column to the desired place.
- Click Apply.
Note: If you generate a report when you have set custom columns, your report keeps the columns you have configured.
Important: If you want to keep your configuration, you need to save it by selecting Save View > Save as. Otherwise, your custom view is not kept when you move to another feature. See AlienVault Generic Data Source for more information.
You can configure the view you want for the list of items in the page.
To create a view configuration
- From the List view,
click the icon.
- Use the and icons to pass the items from one column to another and select the columns you want to see.
- Click Apply.
- If you want to delimit the search, select the filters you want to apply.
Select Save View > Save as.
The Save Current View dialog box opens.
- Enter a name for the view.
- Select Share View if you want to share your view with other users.
- Click Save.
The created view is already selected.
To select a configured view
- From the List view, click View above the filters.
Click Saved views and select the view you want to see.
- Click Apply.
Note: A shared view includes the icon next to its name.
To delete a configured view
- From the
AlienVault Generic Pluginlist view, click View above the filters.
- Click Saved views and click the icon next to the saved view you want to delete.
- Click Accept.
A dialog box opens to confirm the deletion.
Note: You can delete the views you have created.
Important: The icon does not display if the view is selected.