Broker
Overview
The Broker collects messages from Smart Monitor modules into a shared journal and uses these messages to identify objects: hosts, user accounts and other entities. An object card shows information received from the modules and links to other objects.
For example, the Incident Manager reports that an incident was opened on a host, UBA reports a change of the host's risk score, and Inventory reports an asset change. All three messages end up in the card of one object.
Getting Started
To start working with the Broker:
- Enable message intake, add the Broker to the main menu and configure access permissions
- On the Message sources page, choose the modules and message types the journal needs
- Create identification rules that define how objects are identified from messages
- View messages in the journal and object details in their cards
Key Concepts
| Concept | Description |
|---|---|
| Module | a Smart Monitor component that sends messages to the journal, for example Incident Manager or UBA |
| Message | a journal record of what happened in a module: an incident was opened, a risk score changed, an asset was created |
| Message type | a kind of module message, for example Incident opened or Risk score changed |
| Category | the general meaning of a message type. All categories are listed in Message Categories |
| Identity field | a message field used to determine the object, for example a host name or a login |
| Identification configuration | a rule that defines which module fields make messages belong to the same object |
| Object | a Broker record that combines messages from different modules about one entity. Messages belong to one object when the values of their identity fields match under the rules of an identification configuration |
| Link | a relation between two objects that share messages |
Message Categories
| Category | Meaning | Example message type |
|---|---|---|
Signal | the module detected something | Incident opened, Anomaly detected |
State change | the object moved to another state | Risk zone changed, Service state changed |
Data change | the object's details changed | Asset created, Asset changed |
Assessment | a numeric assessment of the object changed | Risk score changed, MITRE ATT&CK risk score assigned |
Action | an action was performed on the object | Incident assigned, Anomaly processed |
Modules and Message Types
| Module | Message types |
|---|---|
Incident Manager | Incident opened, Incident assigned, Incident status changed, Incident closed |
UBA | Anomaly detected, Anomaly processed, Anomaly score changed, Risk score changed, Risk zone changed |
Inventory | Asset created, Asset changed, Asset removed |
RSM or Service Monitor Toolkit | Service state changed, Service metric state changed |
MITRE ATT&CK | MITRE ATT&CK technique detected, MITRE ATT&CK risk score assigned |
Settings
Search Anywhere Framework Broker settings: prerequisites, enabling message intake, journal retention period, access permissions and the main menu.
Message Sources
The Broker Message sources page: select modules and message types for the journal and view module identity fields.
Journal
The Broker journal: messages from all Search Anywhere Framework modules and the result of object identification for each message.
Objects
Broker objects: the list of identified objects and the object card with module data, activity, timeline, messages and the link graph.
Identification Rules
Broker identification rules: creating, changing and deleting identification configurations, rebuild.