Scenario: Monitoring & alerting

Defined in model.py:574

OSSEC watches the app server; encrypted alerts are mailed to admins.

4 open threats, highest risk 6 medium · 4 threats in all · 4 data flows · 3 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_OSSEC_client_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC client";
            URL = "component_OSSEC_client.html";
            tooltip = "OSSEC client";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

        component_Postfix_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Postfix";
            URL = "component_Postfix.html";
            tooltip = "Postfix";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_OSSEC_client_Application_Server -> component_OSSEC_server_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Ship events";    ]
    component_OSSEC_server_Monitoring_Server -> component_Postfix_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Raise alert";    ]
    component_Postfix_Monitoring_Server -> component_SMTP_relay_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Relay mail";    ]
    component_SMTP_relay_External_Services -> actor_Administrator_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Deliver to admin";    ]
}

Sequence Diagram

sequenceDiagram
    participant OSSEC_client as OSSEC client
    link OSSEC_client: Component @ component_OSSEC_client.html
    participant OSSEC_server as OSSEC server
    link OSSEC_server: Component @ component_OSSEC_server.html
    participant Postfix as Postfix
    link Postfix: Component @ component_Postfix.html
    participant SMTP_relay as SMTP relay
    link SMTP_relay: Component @ component_SMTP_relay.html
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html

    OSSEC_client->>OSSEC_server: 1. Ship events
    OSSEC_server->>Postfix: 2. Raise alert
    Postfix->>SMTP_relay: 3. Relay mail
    SMTP_relay->>Administrator: 4. Deliver to admin

Show data flows

ID	Name	Source	Sink	Type
1	Ship events	OSSEC client	OSSEC server	Request
2	Raise alert	OSSEC server	Postfix	Request
3	Relay mail	Postfix	SMTP relay	Request
4	Deliver to admin	SMTP relay	Administrator	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
OSSEC rules configuration error on application server THREAT167	OSSEC client	partially mitigated	9 high	6 medium	Use of Ansible for configuration management for servers
OSSEC and/or Journalist alert SMTP account credentials compromised THREAT69	Postfix	partially mitigated	2 low	2 low	OSSEC emails are gpg encrypted; OSSEC emails should be signed
OSSEC and/or Journalist alert private key compromised THREAT70	Postfix	partially mitigated	2 low	2 low	OSSEC logs do not contain sensitive information.
SMTP relay compromised THREAT71	SMTP relay	partially mitigated	2 low	2 low	OSSEC emails are gpg encrypted; OSSEC emails should be signed

Back to Summary