1. Copyright © 2012 Splunk, Inc.
George Starcher,
University of Alabama at
Birmingham

2. About UAB
Established in 1969
17,999 students
Peak 150 GB log data/day
2

3. About the Speaker
George Starcher, Data Security Coordinator
Was with Cinram for 14 years and discovered Splunk there
– Splunk fit my philosophy from my retail loss prevention days
“My job exists at UAB because of Splunk”
Log all the things.
– RaspberryPi + Splunk Storm = Optimal Laundry Time
– http://www.georgestarcher.com/?p=398
3

4. University of Alabama at Birmingham
Problem
• No solid log collection platform
• Reduce Intrusion Detection Time
• IP to User attribution
Results
• Search functionality allows for quick and
easy resolution
• Address security risks with alerts
• Resolving DMCA compliance issues easier
4

5. Splunk for Compliance
5

6. Battling Copyright Infringement with Splunk
Identify specific users illegally
sharing files
– DMCA Complaint provides IP and time
– Issue is connecting person’s user ID, IP,
and Mac address
Went from taking several days to minutes for resolution
6

7. Search Macro
wifiuser-ip(1) sourcetype="dhcp-syslog" OR sourcetype="aruba-
syslog" OR sourcetype="bradford-syslog" NOT DBUG
[search sourcetype="dhcp-syslog" OR
sourcetype="aruba-syslog" OR sourcetype="bradford-
syslog" $ipaddress$ | dedup mac_address | eval
mac_address=lower(mac_address) | fields
mac_address] | eval
mac_address=lower(mac_address) | search
$ipaddress$ | transaction mac_address
startswith="Authentication Successful" | where
duration >0 | eval starttime=_time | eval
endtime=_time+duration | eval
end_time=strftime(endtime, "%m/%d/%y %I:%M:%S
%p") | table _time, end_time, duration, blazer_id,
src_ip, mac_address
7

8. Splunk for Security
8

9. Identifying Compromised User Credentials
Identify compromised user credentials through VPN and reverse proxy logs
– ID logging in from China to SSL VPN using Google Translate as a proxy
Reduce impact of attacks by daily review
– IPs from non-US sources
– Anything in the IP range for Google Translate
9

10. 10

11. 11

12. Saved Searches
sourcetype=vpn-syslog | transaction startswith="Authentication Successful"
endswith="Disconnected" keepevicted=true blazer_id | eval ip=src_ip | lookup dnsLookup ip
| geoip src_ip | search src_ip_country_code=* NOT src_ip_country_code=US OR
(src_ip="74.125.0.0/16" OR src_ip="207.126.144.0/20" OR src_ip="64.18.0.0/20" OR
src_ip="64.233.160.0/19")| table _time, blazer_id, uab_src_ip, src_ip, hostname,
src_ip_country_name
index="app_ezproxy*" NOT sourcetype=ezprozy_messages NOT domain=*ebsco* NOT
domain=*uab.edu | geoip src_ip | search NOT src_ip_country_code="US" | eval
MB=(bytes/1024/1024) | transaction session_id | stats sum(MB) AS totalMB by user,
src_ip_country_name | eval MB=round(totalMB,0) | table user, src_ip_country_name, MB
12

13. Brand Monitoring – Google Hacking
Google Hacking
– Python script taking known Google hacking search strings. Uses the Google API
– Run saved searches against Google for our domain and take the results into
Splunk
13

14. Location, location…location
Google maps App
– Hacked the app by showing specific
buildings by longitude and latitude
– Show sources by tripped IPS rule
14

15. 15

16. Location, location…location
Fun with wifi logs: regex building code, lookup table to details
Feb 26 23:59:49 x.x.x.x stm[537]: <501093> <NOTI> |AP 341WWAP1S04@x.x.x.x stm| Auth success: 8c:a9:82:00:00:00: AP x.x.x.x-00:0b:86:00:00:00-
341WWAP1S04
16

17. 17

18. Security Other Splunk Uses
• Until we get the Enterprise Security Application in place made our
own dashboards
• Security Daily Events [ SSH outbound, IDS/IPS Events, SSH/RDP In]
• Linux Log Review [Interfaces to Promiscuous Mode, Root Activity, User
Activity, Disk/File Errors, SUDO activity and SU activity]
• Rolling Hour alerts on Domain Account across multiple workstations
18

19. AHA!
The ability to correlate the log types
The ability to keep improving parsing over time
The metadata about the data
Transaction command is really fun
Being able to pull reports for upper level management in
minutes vs. taking hours to produce a single monthly
report. Especially with the attribution to location or
system owner.
19

20. Deployment Gotchas
A good inventory
Making a weekly progress of log collection completion
The system admins have to ensure logging configuration
– Syslog vs local retention when moving to Splunk forwarders
Hosts behind NAT
Good index planning for delegation of access
Understand white/blacklist behavior in deployment server; Don’t make
typos in serverclass.conf
20

21. What is Next
Enterprise Security Application
Indexer Replication
Need to clean up my own
enhancements into apps
Data Retention
FISMA/PCI
21

22. Thank You!