Recomendados
Recomendados
Mais conteĂșdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
Semelhante a Splunk live nyc_2017_sec_buildinganalyticsdrivensoc (20)
Ăltimo
Ăltimo (20)
Splunk live nyc_2017_sec_buildinganalyticsdrivensoc
- 1. © 2017 SPLUNK INC.© 2017 SPLUNK INC. JULY 11, 2017 | NYC
- 2. © 2017 SPLUNK INC. Building the Analytics-Driven SOC Rene Aguero | Security Strategist JULY 11, 2017 | NYC
- 3. © 2017 SPLUNK INC. 3 3 > RenĂ© AgĂŒero raguero@splunk.com âą 2 years at Splunk â Security Strategist âą 18 years in security â MCSE NT3.51 âą CISSP, MSBA â Information Assurance (forensics, auditing and security) âą IT and Security Director âą Offensive Security âą Exploitation â Metasploit, Web attacks âą Rapid7 SE Director $whoami
- 4. © 2017 SPLUNK INC. During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved. Safe Harbor Statement
- 5. © 2017 SPLUNK INC. 1. A look at traditional security operations 2. Best practices and emerging trends 3. The security ops technology stack 4. How to use Splunk solutions for an Analytics-Driven SOC 5. Customer Successes Agenda
- 6. © 2017 SPLUNK INC. Source : EY Global Information Security Survey 2015
- 7. © 2017 SPLUNK INC. Source : EY Global Information Security Survey 2015
- 8. © 2017 SPLUNK INC. Traditional Security Operations
- 9. © 2017 SPLUNK INC. How-to guidesâŠ
- 10. © 2017 SPLUNK INC. Security Programs: The Big Picture [13] https://www.sans.org/security-resources/posters/leadership/security-leadership-poster-135 [14] http://rafeeqrehman.com/2016/10/07/announcing-ciso-mindmap-2016/
- 11. © 2017 SPLUNK INC. [13] https://www.sans.org/security-resources/posters/leadership/security-leadership-poster-135 [14] http://rafeeqrehman.com/2016/10/07/announcing-ciso-mindmap-2016/ Security Programs: The Big Picture Itâs complicatedâŠ
- 12. © 2017 SPLUNK INC. 12 What do we see? A Traditional Security Critical Path 12 Risk & Compliance Security Architecture Security Engineering Security Operations (Includes SOC) Security Operations: part of the bigger pictureâŠ
- 13. © 2017 SPLUNK INC. ⶠVirtual SOC (VSOC) ⶠMultifunction NOC/SOC ⶠCommand SOC ⶠCo-Managed SOC ⶠCrew SOC? (This oneâs ours) Types of Traditional SOCs⊠[1] https://www.gartner.com/doc/3479617
- 14. © 2017 SPLUNK INC. âA perception of the SOC as a big alert pipeline is outdated and does not allow the organization to make use of more active processes such as internal TI generation and threat hunting.â â [1] Anton Chuvakin https://www.gartner.com/doc/3479617 Traditional SOC Alert Pipeline?
- 15. © 2017 SPLUNK INC. Three Interrelated Components of Security Process PeopleTechnology
- 16. © 2017 SPLUNK INC. Bottom Line Technology exists to serve people and processes.
- 17. © 2017 SPLUNK INC. Traditional SOC Challenges (1) Efficacy
- 18. © 2017 SPLUNK INC. Traditional SOC Challenges (2) Staffing
- 19. © 2017 SPLUNK INC. Challenges with the traditional SOC (3) Remember this? Risk & Compliance Security Architecture Security Engineering Security Operations (Includes SOC)
- 20. © 2017 SPLUNK INC. Challenges with the traditional SOC (3) Silo-ization
- 21. © 2017 SPLUNK INC. Challenges with the traditional SOC (4) ⊠and opportunity cost COST
- 22. © 2017 SPLUNK INC. Trends in Security Operations
- 23. © 2017 SPLUNK INC. ⶠSecurity Analytics Center ⶠCyber Fusion Center ⶠCyber Defense Center ⶠThreat Defense Center ⶠDetection and Response Team A SOC By Any Other NameâŠ
- 24. © 2017 SPLUNK INC. ⶠAlert Management ⶠIncident Response ⶠToolchain engineering ⶠThreat intelligence (consumption and creation) ⶠThreat hunting ⶠVulnerability management ⶠRed team New Capabilities in the SOC Security Operations Alert Management IR / CSIRT Toolchain Engineering Threat intelHunting Vuln. Management Red Team
- 25. © 2017 SPLUNK INC. SOC Persona Responsible for the technology, product, upgrades SIEM Admin, Tools Engineer Security Analyst Hunter, Incident Responder SecOps / SOC Manager / Director CISO / VP / Head InfoSec Responsible for investigating alerts, incidents and triage Responsible for SOC process, initiatives, often budget Proactively/reactively hunts for threats. Details investigations, determine scope of incident, breach and takes actions Head or Exec of Info Security, Security
- 26. © 2017 SPLUNK INC. ⶠTier-1 ⶠOff hours ⶠToolchain ops ⶠOutside Help With Specialties ⹠Reverse Engineering ⹠Forensics ⹠Advanced IR ⹠Red team Managed Security Services are Common
- 27. © 2017 SPLUNK INC. ⶠSeeking to âAutomate Tier 1â ⶠWhat do you automate? âą Context gathering/enrichment â definitely âą Configuration changes â maybe âą Evidence collection â probably ⶠHigh premium on toolchain integration ⶠSecurity engineers are quickly becoming programmers Automation in the SOC
- 28. © 2017 SPLUNK INC. Improved Processes in the SOC https://conf.splunk.com/files/2016/slides/maturing-workdays-soc-with-splunk.pdf
- 29. © 2017 SPLUNK INC. ⶠThreat list + raw log feed = Noise ⶠAlert enriched by threat intel = Insight ⶠHigh maturity: âą Gather your own threat intel âą Share threat intel meaningfully Maturing Use of Threat Intelligence âBeware the threat list wind tunnelâ â Splunk Customer
- 30. © 2017 SPLUNK INC. 30 Network (Meta)data
- 31. © 2017 SPLUNK INC. 31 Network (Meta)data NetFlow (or variant) Succinct 5-tuple + traffic size Easytm to analyze Cost effective No payload PCAP Voluminous Ground truth Ultimate context Full payload Lots of storage / overhead Splunk Stream Succinct 5-tuple + traffic size Easily searchable! Tuneable Adaptive fidelity Additional context Payload elements
- 32. © 2017 SPLUNK INC. Threat hunting is what happens just past the horizon of automated detection capabilities. What you learn while hunting should extend that horizon. â Paraphrased from Robert M. Lee SANS Forensics 578 Threat Hunting â Where Does it Fit?
- 33. © 2017 SPLUNK INC. The Security Operations Toolchain
- 34. © 2017 SPLUNK INC. ⶠSingle source of truth ⶠRetention and integrity ⶠAny data source ⶠEasy correlation ⶠAutomation / integration ⶠPerformant and scalable ⶠFull fidelity ⶠNormalized? ⶠHunting ⶠForensic investigation ⶠAlerting ⶠDashboards ⶠVisualization ⶠAnalytics (ML?) Log Data Platform
- 35. © 2017 SPLUNK INC. âThe organization consuming the data must develop and consistently use a standard format for log normalization.â â Jeff Bollinger et. al., Cisco CSIRT Your fields donât match? Good luck creating investigative queries. Data Normalization is Mandatory for your SOC
- 36. © 2017 SPLUNK INC. ⶠOften multiple sources of record â thatâs OK âą CMDB, Vuln scans, Passive detection, DHCP, NAC âą Active directory, LDAP, IAM ⶠNetwork diagrams ⶠCategorization âą PCI, ICS, Administrative, Default ⶠComprehensive yet lightweight and easy to maintain ⶠMust be easy to correlate to log data Asset Inventory and Identity Data
- 37. © 2017 SPLUNK INC. 1. Ticketing system 2. Workflow 3. Supports prioritization 4. Supports collaborative investigation 5. Provides metrics 6. Supports automation 7. Auditable Case and Investigation Management
- 38. © 2017 SPLUNK INC. 1. Assets and Identities 2. Threat intel 3. Firewall 4. Network metadata 5. Authentication 6. Server (Windows / Linux) 7. Endpoint 8. IDS / IPS 9. VPN 10.Application 11.Vulnerability Common SOC Data Sources
- 39. © 2017 SPLUNK INC. Splunk for Analytics-Driven SOC
- 40. © 2017 SPLUNK INC. ⶠAutomatically collect, aggregate and de-duplicate threat feeds from a broad set of sources ⶠSupport for STIX/TAXII, OpenIOC, Facebook ⶠBuild your own data to create your own Threat Intel ⶠOut of the box Activity and Artifact dashboards 1. Threat Intelligence â ES Threat Intel Framework ⶠDetermine impact on network, assets ⶠUse for analysis / IR ⶠCollect / provide forensics ⶠUse to hunt / uncover / link events ⶠShare info with partners Law Enforcement Feeds ISAC Feeds Agency Feed Commercial Service Community Feed Open-Source Feed Other Enrichment Services
- 41. © 2017 SPLUNK INC. Data Management Threat Activity Correlation Data / Notable Events Data Search Threat Intelligence Framework Collect, Manage Categorize Correlate Search
- 42. © 2017 SPLUNK INC. ⶠSimplify detection and focus on real alerts ⶠAccelerate anomaly and threat detection â minimize attacks and insider threat ⶠUse machine learning toolkit - solutions to suit your workflow ⶠPremium machine learning solution - User Behavior Analytics âą Flexible workflows for SOC Manager, SOC analyst and Hunter/Investigator within SIEM 2. Use Advanced Analytics â Native ML and UBA
- 43. © 2017 SPLUNK INC. Statistical Analysis Advanced Analytics and Machine Learning 101111101010010001000001 111011111011101111101010 010001000001111011111011 workflow Threats Anomalies UBA-based Machine Learning (Threat/Anomalies) UBA-based identity context Entity Resolution DIY Machine Learning DIY Statistical Analysis Alert driven detection On-Premises Private Cloud Public Cloud Storage Online Shopping Cart Telecoms Desktops Security Web Services Networks Containers Web Clickstreams RFID Smartphones and Devices Servers Messaging GPS Location Packaged Applications Custom Applications Online Services DatabasesCall Detail Records Energy Meters Firewall Intrusion Prevention UBA Machine Learning + Data Science UBA-based Machine Learning (Threat/Anomalies) Packaged UBA-based ML + DS (Custom Threats)
- 44. © 2017 SPLUNK INC. ⶠUse rules to automate routine aspects of detection and investigation ⶠExtract insights from existing security stack by use of common interface ⶠTake actions with confidence for faster decisions and response ⶠAutomate any process along the continuous monitoring, response and analytics cycle 3. Automate When Feasible Splunk Adaptive Response Identity and Access Internal Network Security Endpoints OrchestrationWAF & App Security Threat Intelligence Network Web Proxy Firewall
- 45. © 2017 SPLUNK INC. ⶠCentrally automate retrieval, sharing and response action resulting in improved detection, investigation and remediation times ⶠImprove operational efficiency using workflow- based context with automated and human-assisted decisions ⶠExtract new insight by leveraging context, sharing data and taking actions between Enterprise Security and Adaptive Response partners Adaptive Response: Analytics-Driven Decisions, Automation
- 46. © 2017 SPLUNK INC. 4. Proactively Hunt and Investigate - Considerations ⶠOrganizational maturity ⶠDomain and product experience ⶠTools: Network, Endpoint, Threat Intel, Access ⶠSecurity relevant data, historical, raw data ⶠFlexibility and ad hoc HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running âallowedâ programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 47. © 2017 SPLUNK INC. How Splunk Helps You Drive Threat Hunting Maturity Enrichment Automation Search & Visualization Hypotheses Automated Analytics Data Science and Machine Learning Data and Intelligence Enrichment Data Search Visualisation Threat Hunting Enablement Integrated & out of the box automation tooling from artifact query, contextual âswim-lane analysisâ, anomaly & time series analysis to advanced data science leveraging machine learning Threat Hunting Data Enrichment Enrich data with context and threat-intel across the stack or time to discern deeper patterns or relationships Search & Visualize Relationships for Faster Hunting Search and correlate data while visually fusing results for faster context, analysis and insight Ingest & Onboard Any Threat Hunting Machine Data Source Enable fast ingestion of any machine data through efficient indexing, a big data real time architecture and âschema on the readâ technology DATA MATURITY
- 48. © 2017 SPLUNK INC. ⶠCorrelation across all security relevant data ⶠInsights from existing security architectures ⶠAdvanced analytics techniques such as machine learning 5. Adopt an Adaptive Security Architecture To Prevent, Detect, Respond and Predict â need: 1,000+ Apps and Add-ons Splunk Security Solutions
- 49. © 2017 SPLUNK INC. Insight From Across Ecosystem Effectively leverage security infrastructure to gain a holistic view Identity and Access Internal Network Security Endpoints OrchestrationWAF & App Security Threat Intelligence Network Web Proxy Firewall +
- 50. © 2017 SPLUNK INC.
- 51. © 2017 SPLUNK INC. Splunk Analytics-Driven SIEM MONITOR REPORT ANALYZE INVESTIGATE RESPONSE COLLABORATE DETECT ALERT ReportAd hoc Search AnalyzeCollect Store Pre-defined views and rules Analysis investigation & context enrichment Enterprise- wide coordination & response Correlation rules, thresholds SIEM Security ops management alert & incident management, policy based rules, out-of-box security rules & analysis DATA PLATFORM Collect, Index data for search and analysis, visualization. Dynamic ad hoc and statistical analysis FUNCTIONS
- 52. © 2017 SPLUNK INC. Splunk Enterprise Security A collection of Frameworks NOTABLE EVENT THREAT INTELLIGENCE ASSET AND IDENTITY CORRELATION ADAPTIVE RESPONSE RISK ANALYSIS Platform for Operational Intelligence
- 53. © 2017 SPLUNK INC. Splunk Enterprise Security: Frameworks Framework Detail Notable Events Identify noteworthy incidents from events and then manage state Asset & Identity performs asset and identity correlation for fields that might be present in an event Threat Intelligence Consume and manage threat feeds, data Risk Analysis Identify actions that raise the risk profile of individuals or assets Adaptive Response Interface for retrieving, sending and running actions by integrating with external applications
- 54. © 2017 SPLUNK INC. Splunk Solutions Portfolio Across Data Sources, Use Cases & Consumption Models Rich Ecosystem of Apps & Add-Ons Splunk Premium Solutions Mainframe Data Relational Databases MobileForwarders Syslog/ TCP IoT Devices Network Wire Data Hadoop Platform for Operational Intelligence
- 55. © 2017 SPLUNK INC. Threat Activity Dashboard Splunk Quick Start for SIEM Rapidly Determine Advanced Malware and Threat Activity Malware Center Dashboard
- 56. © 2017 SPLUNK INC. Customer Success
- 57. © 2017 SPLUNK INC. Challenges ⶠExisting SIEM not adequate - struggled to bring in appropriate data ⶠUnable to perform advanced investigations, severe scale/performance issues ⶠLooking to build a new SOC with modern solution Customer Solution ⶠCentralized logging of all required machine data at scale and full visibility ⶠRetain all relevant data from 10+ data sources which is used by 25+ SOC/CSIRT users ⶠTailored advanced correlation searches & IR workflow ⶠFaster and deeper incident investigations ⶠGreater SOC efficiencies - all SOC/CSIRT working off same UI/data ⶠExecutive dashboards to measure and manage risk TECHNOLOGY Building an Intelligence Driven SOC
- 58. © 2017 SPLUNK INC. Challenges ⶠSlow responses to security incidents ⶠInadequate situational awareness of security events ⶠLimited threat intelligence ⶠDisparate logs from over 40 departments were difficult to aggregate Customer Solution: Splunk Cloud with Enterprise Security ⶠReal-time, citywide, 24/7 network surveillance ⶠStronger protection of digital assets and infrastructure ⶠShared threat intelligence with federal agencies ⶠReduced headcount and lower operational costs PUBLIC SECTOR Citywide SOC for Situational Awareness
- 59. © 2017 SPLUNK INC. Wrapping up
- 60. © 2017 SPLUNK INC. FREE CLOUD TRIAL FREE SOFTWARE DOWNLOAD FREE ENTERPRISE SECURITY SANDBOX Get started in minutes â splunk.com 1 2 3
- 61. © 2017 SPLUNK INC. SEPT 25-28, 2017 Walter E. Washington Convention Center Washington, D.C. .conf2017 The 8th Annual Splunk Conference conf.splunk.com You will receive an email after registration opens with a link to save over $450 on the full conference rate. Youâll have 30 days to take advantage of this special promotional rate! SAVE OVER $450
- 62. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
- 63. Acceleration Workshops ⶠES Benchmark ⹠Used to help existing customers optimize their Splunk ES investment ⶠSecurity Readiness Review (CSC 20, SIEM+, SOC) ⹠Designed to accelerate and expand opportunities in the pre-sales phase by providing discovery and guidance in areas of business risk, security goals, use case definition, data source mapping & value realization ⶠThreat Hunting Workshop ⹠Designed to provide thought leadership and hands on experience of threat hunting using Splunk.
- 64. © 2017 SPLUNK INC. Take the Survey on Pony Poll ponypoll.com/slny Complete the survey for your chance to win a .conf2017 pass
- 65. © 2017 SPLUNK INC. 1. How to Plan, Design, Operate and Evolve a SOC âą https://www.gartner.com/doc/3479617 2. Crafting the InfoSec Playbook âą https://www.amazon.com/Crafting-InfoSec-Playbook-Security-Monitoring/dp/1491949406 3. Splunk SOC Advisory Services âą https://www.splunk.com/pdfs/professional-services/soc-advisory-services.pdf 4. Ten Strategies of a World-Class Cybersecurity Operations Center âą https://www.mitre.org/sites/default/files/publications/pr-13-1028-mitre-10-strategies-cyber-ops-center.pdf 5. Maturing Workdayâs SOC with Splunk âą https://conf.splunk.com/files/2016/slides/maturing-workdays-soc-with-splunk.pdf 6. The Five Characteristics of an Intelligence Driven Security Operations Center âą https://www.gartner.com/doc/3160820/characteristics-intelligencedriven-security-operations-center 7. The Who, What, Where, When, Why and How of Effective Threat Hunting âą https://www.sans.org/reading-room/whitepapers/analyst/who-what-where-when-effective-threat-hunting-36785 Resources Cited (1)
- 66. © 2017 SPLUNK INC. 8. Exploring the Frameworks of Splunk Enterprise Security âą https://conf.splunk.com/files/2016/slides/exploring-the-frameworks-of-splunk-enterprise-security.pdf 9. Recruiting and Retaining Cybersecurity Ninjas âą https://www.csis.org/analysis/recruiting-and-retaining-cybersecurity-ninjas 10. Building Threat Hunting Strategies with the Diamond Model âą http://www.activeresponse.org/building-threat-hunting-strategy-with-the-diamond-model/ 11. Using Robots to Fight Bad Guys âą https://sroberts.github.io/2014/05/14/using-robots-to-fight-bad-guys/ 12. Building a SOC with Splunk âą https://www.splunk.com/pdfs/technical-briefs/building-a-soc-with-splunk-tech-brief.pdf 13. SANS Security Leadership Poster âą https://www.sans.org/security-resources/posters/leadership/security-leadership-poster-135 14. 2016 CISO MindMap â What do InfoSec Professionals Do? âą http://rafeeqrehman.com/2016/10/07/announcing-ciso-mindmap-2016/ Resources Cited (2)
Notas do Editor
- This hour is intended to be educational, and weâre relying heavily on a LOT of great resources like these. Everything from Oreily books to Gartner reports to Splunk conf presentations to blog posts. All these resources are cited both on the slide where they are referenced and at the end of the presentation.
- Before we talk about Security Operations, and Security Operations _Centers_, we should understand the big picture. Security Operations is usually just a part of a bigger security program. Here are some examples of popular âCISO Mind Mapsâ, one from SANS, one from a security blogger Rafeeq Rahman, one created by yours truly (Dave H) for a consulting customer years ago.
- When you look at these mind maps, you recognize one thing. Security programs are complicated. Letâs simplify it a bit by describing what we most often see at our customers.
- We very often see this type of traditional organizational model for a security program. Risk and compliance defines what needs to be protected, If they are advanced this is done through a formal risk analysis framework like FAIR, Octave, etc. Architecture looks at the risk register and chooses controls to mitigate them. Could be architectural like network segmentation or designing for optimal choosing sensor locations, and often includes choosing products like endpoint protection, firewalls, data collection, SIEM, automated file analysis, sandbox, etc. Defense in depth strategies are usually defined here. Security engineers install and maintain the security toolchain. They keep the security systems up and running so that Operations can do the day to day work of security. Security operations.
- There are a lot of different types of SOCs. Here are some that Anton Chuvakin dexcribes in his recent Gartner paper. A virtual SOC is made up of remote analysts without a dedicated facility. If you use an MSSP exclusively, you have a VSOC. Some organizations combine operations capabilities like NOC or helpdesk into what you might call a multi-function SOC. A command SOC is a SOC of SOCs, something we at splunk often see in large multi-national organizations. A co-managed SOC is common when an MSSP performs part of the SOC duties. Splunkers often see âCrew SOCsâ which is something of a volunteer fire department. When an incident occurs, we get the crew together to analyze and respond. (yikes?)
- We very often see organizations who fall into something we call the Alert Triage trap. Anton Chuvakin included mention of the alert pipeline when discussing common mistakes made by organizations implementing SOCs. Is this really a bad thing? Yes and no. Certainly every SOC needs the core capability to triage incoming alerts effectively. If, however, the identity of the entire SOC becomes âalert pipelineâ it can rob the team of the opportunity to focus on whatâs becoming increasingly important in SOCs of the future. Weâll talk more about those as we move through todayâs presentation.
- This is an old Splunk Slide! And itâs an old security concept. Itâs still valid too! Security folks like me talk about People Process and Technology all the time. We donât need to dwell on this too long, but the one thing to take away from this talk today is this <click>
- The bottom line is that technology exists to serve people and processes. Itâs not to say that people will not have learn and to adapt to the chosen toolchain. Thatâs reality. But what it _does_ mean that if you are spending all your time trying to re-organize around a specific technology-or worse yet-if you are avoiding important detection and response capabilities because the technology cannot support them, then you may have a technology problem. Weâll talk more about how the Splunk security product portfolio(including Splunk Core, Splunk Enterprise Security, the PCI App, and Splunk UBA) can help later. For now letâs talk more about challenges we see in traditional SOCs.
- We have plenty of examples in the industry of traditional SOCs simply not getting the job done. In one such high profile case details have surfaced indicating several actual malware events reported from a popular security product were ignored, or triaged improperly. http://www.darkreading.com/attacks-and-breaches/target-ignored-data-breach-alarms/d/d-id/1127712
- As weâve mentioned, a traditional SOC is heavily reliant on people. Good SOC analysts are difficult to find and retain.
- Remember this tidy little diagram of the security critical path? Unfortunately we see it often turn into something like this:
- Often ends up like this. Silo-ization.
- SOCs are expensie to run, and you always have to consider not just the bottom line, but what kind of return are you missing out on by not having those resources invested in revenue generating activity?
- One trend weâre seeing with next generation security operations centers is they are no longer called SOCs! Here are a few of the cool new names weâve run across.
- It isnât just us that thinks some form of data normalization is a good idea, especially for security analytics. If you havenât checked it out, thereâs a fantastic book published recently by three guys that work in the Cisco CSIRT, and they detail their extensive use of Splunk for security analysis. They make a strong point early on in the book about the role of data normalization. They mention that each event generated should have the⊠-Date and Time -Type of action performed -Subsystem performing the action -Identifiers for the object requesting the action -Identifiers for the object providing the action -Status, outcome, or result of the action So CIM helps us get significant regularity out of similar but disparate data types. Also allows cross-domain correlation like IDS to Vuln.
- Splunk & TH: 1. Ingest & Onboard Any Threat Hunting Machine Data Source Enable fast ingestion of any machine data through efficient indexing, a big data real time architecture and âschema on the readâ technology 2. Threat Hunting Data Enrichment Enrich data with context and threat-intel across the stack or time to discern deeper patterns or relationships 3. Threat Hunting Automation Integrated out of the box automation tooling from artifact query, âcontextual swim-lane analysisâ, anomaly & time series analysis to advanced data science leveraging machine learning 4. Search & Visualise Relationships for Faster Hunting Search and correlate data while visually fusing results for faster context, analysis and insight
- One way to answer the question âWhat is Enterprise Security?â, and the way weâll look at it today, is to consider the Frameworks that comprise it. Today weâll focus on these 5, but weâll do so in little bit different way. Instead of showing you how ES leverages these frameworks together to meet general security problems, weâre going dive deeper and show you how to treat the ES frameworks as building blocks that can be assembled to meet complex use cases in novel, and perhaps non-obvious ways. That might mean using a little-known ES search macro directly in core Splunk; or it might mean making a call to an ES-specific REST endpoint; or it might mean showing a bit of Python code that connects ES to an external service provider. The ES frameworks, along with some very nice dashboards, and of course your organizations security data, make up ES.
- Todayâs enterprise requires big data security solutions that can monitor and investigate advanced threats and attacks and enable rapid incident response. The Splunk Quick Start for SIEM provides a fast approach to get you up and running using Splunk Enterprise Security, an analytics-driven security information and event management solution. Quickly determine threat and malware activity within your environment Use the full capability of Splunk Enterprise Security to solve a wide range of SIEM use cases Use your education credit and .conf event passes to solve additional use cases Scalable packages available in medium and large sizes to meet your needs
- Industry âą Technology Splunk Use Cases âą Application delivery âą IT operations âą Security Challenges Needed to create a world-class SOC with superior response and maturity levels Lacked SIEM solution Wanted full visibility across silos to rapidly search and analyze security-related events Seeking agile solution to decrease MTTR Splunk Products âą Splunk Enterprise âą Splunk Enterprise Security Data Sources Palo Alto Networks and Juniper firewalls Sourcefire and Snort intrusion detection systems Anti-virus systems McAfee vulnerability scans Windows and Linux server OS logs Apache and IIS web server application logs Active Directory domain controllers IronPort email security appliance and email/ SMTP servers Case Study http://www.splunk.com/en_us/customers/success-stories/saic.html
- https://fieldenablement.splunk.com/previewhtml.asp?id=100
- Donât forget to complete todayâs survey at ponypoll.com/_____ for your chance to win a .conf2017 pass. A winner will be identified tomorrow through a random drawing from completed surveys and will be notified via email.