Proxywatch feature in Stealthwatch

mshboul89 — Tue, 20 Aug 2019 19:29:59 GMT

As i understand, Proxywatch feature should correlate the external proxied IP/port with the real client IP/port, so that we get to know the real user IP that corresponds to a specific proxied access as seen from outside the proxy.

I am using WSA with Stealthwatch in my case, where WSA sends proxy logs in W3C format to FC.

The question is:

How does stealthwatch correlate the external and internal proxy connections ? Based on which fields ?

Thanks in advance.

Re: Proxywatch feature in Stealthwatch

hanjabbo — Sun, 08 Sep 2019 07:23:48 GMT

For the proxy watch feature to work properly you have to have flow from before the proxy and from after the proxy in addition to the proxy logs . the correlation happens using the timestamps, source ip /port, destination ip / port. from flows before and after in addition to the logs

topic Proxywatch feature in Stealthwatch in Security Analytics

Proxywatch feature in Stealthwatch

Re: Proxywatch feature in Stealthwatch