SlideShare a Scribd company logo

SplunkLive! Stockholm 2015 breakout - Analytics based security

•
•
Splunk
Splunk

This document discusses how Splunk can be used for security analytics and threat detection. It describes how Splunk allows organizations to centrally gather and correlate security-related data from various sources like networks, endpoints, applications and threat intelligence feeds. This enables use cases like monitoring for known threats, detecting unknown threats, incident investigation and user behavior analytics. Advanced techniques like machine learning and user/entity behavior analytics are also discussed to help identify anomalous activity that could indicate security incidents or threats.

Technology
1 of 40
Copyright  ©  2015  Splunk  Inc.   Splunk  for  Security  –  AKA   Analy>cs  based  security   Niklas  Blomquist   SME  Security  
2   Agenda   •  Advanced  aCacks  are  hard  to  find   •  How  to  use  Splunk  for  Security   •  Most  common  use-­‐cases   •  How  to  add  value  to  exis>ng  data   •  How  to  detect  new  threats   •  User  Behavior  Analy>cs   •  News  in  ES  4.0  
Advanced  Threats  Are  Hard  to  Find   Cyber  Criminals     Na8on  States     Insider  Threats     Source:  Mandiant  M-­‐Trends  Report   100%    Valid  creden>als  were  used   40     Average  #  of  systems  accessed   205   Median  #  of  days  before  detec>on   67%   Of  vic>ms  were  no>fied  by   external  en>ty  
4   Tradi>onal  approaches  are  not  good  enough   •  Preven>on  of  breaches  will  fail!   •  Invest  more  in  detec>on   •  Gather  all  data  in  one  place   •  Enrich  data  with  context   •  Make  it  easy  to  search  in  the  data   •  Make  it  easy  to  do  advanced  analy>cs   4  
5   SPLUNK FOR SECURITY “Connects People and Data with Context and Extended Intelligence”
6   Monitoring,   Correla8ons,   Alerts   Ad  Hoc     Search  &   Inves8gate   Custom     Dashboards   And  Reports   Analy8cs  And   Visualiza8on   Developer   PlaQorm   All  SOC  Needs  &  Personnel   Security  Intelligence  Pla[orm   6       Real-­‐8me   Machine  Data   Cloud     Apps   Servers   Email   Web   Network   Flows   DHCP/  DNS   Custom   Apps   Badges   Intrusion     Detec>on   Firewall   Data  Loss   Preven>on   An>-­‐Malware   Vulnerability   Scans   Authen>ca>on   Storage   Industrial   Control   Mobile   Security  Intelligence  PlaQorm   Threat   Feeds   Asset     Info   Employee   Info   Data   Stores   Applica8ons   External  Lookups  /  Enrichment  
7   Enables  Many  Security  Use  Cases     SECURITY  &                     COMPLIANCE   REPORTING   REAL-­‐TIME   MONITORING  OF   KNOWN  THREATS   DETECTING     UNKNOWN   THREATS   INCIDENT   INVESTIGATIONS   &  FORENSICS   FRAUD     DETECTION   INSIDER     THREAT   Security  Intelligence  PlaQorm   7  
Add  value  to  exis>ng  data  
9   A  fire!   Is  there  a  real  danger?  
10   Adding  context   BBQ  vs  house  on  fire  
11   Context  =  knowledge  around  the  data   "   Importance  of  assets  and  iden>>es   "   Is  this  a  bad  know  ip/domain/e-­‐mail   "   Should  user  access  the  SQL  server   "   Should  server  communicate  X   "   Make  data  easier  to  understand  
12   Data  from  An>-­‐Virus/An>-­‐Malware   "   No  need  to  act  if  removed   "   But  what  if;   –  The  hosts  are  re-­‐infected?   –  Mul>ple  hosts  are  infected  in  short  >me   –  If  the  CEO/CFO/CSIO  computer  are  infected?   –  Host  are  the  webshop/Internetbank/important  system   –  Other  sources  alerts  within  short  >meframe     12  
13  
14   Alerts  on  most  cri>cal  events  
15   Inves>gate  the  incident  
16   Visual  Inves>ga>ons  for  All  Users  
How  to  find  new  threats   17  
Threat  intelligence   Auth  -­‐  User  Roles,   Corp  Context   Host     Ac8vity/Security   Network     Ac8vity/Security   18   Advanced  Threat  Detec>on  &  Response   WEB   Conduct   Business   Create  addi8onal   environment   Gain  Access     to  system  Transac8on   MAIL   .pdf   Svchost.exe  Calc.exe   Events  that     contain  link  to  file   Proxy  log   C2  communica>on     to  blacklist   How  was     process  started?   What  created  the   program/process?   Process  making   C2  traffic   Web   Portal  .pdf  
Threat  intelligence   Auth  -­‐  User  Roles,   Corp  Context   Host     Ac8vity/Security   Network     Ac8vity/Security   Command  &  Control  Exploita8on  &  Installa8on  Delivery   MAIL   WEB   WEB   FW   Accomplish  Mission       Start  Anywhere,  Analyze  Up-­‐Down-­‐Across-­‐Backwards-­‐Forward   phishing   Download   from   infected  site   1   2   5   6   7   8   3   4   Iden>ty,  Roles,  Privileges,  Loca>on,  Behavior,  Risk,  Audit  scope,  Classifica>on,  etc.     •  Third-­‐Party  Threat  Intel   •  Open  source  blacklist   •  Internal  threat  intelligence   •  Firewall   •  IDS  /  IPS   •  Vulnerability  scanners   •  Web  Proxy   •  NetFlow   •  Network   •  Endpoint  (AV/IPS/FW)   •  Malware  detec>on   •  PCLM   •  DHCP   •  OS  logs   •  Patching   •  Ac>ve  Directory   •  LDAP   •  CMDB   •  Opera>ng  System   •  Database   •  VPN,  AAA,  SSO  
Copyright  ©  2015  Splunk  Inc.   Splunk  User   Behavior  Analy8cs   (UBA)     Powered  by  Caspida  
Tradi8onal  SIEM   SIGNATURES   RULES   HUMAN     ANALYSIS  
DATA-­‐SCIENCE  DRIVEN   BEHAVIORAL  ANALYTICS   BIG  DATA     DRIVEN   SECURITY   ANALYTICS   MACHINE   LEARNING   A  NEW  PARADIGM  
23   MAPPING  RATs     TO       ACTIONABLE  KILL-­‐CHAIN   A W N O M A L I E S H R E A T
24   CYBER  ATTACK   24   USER ACTIVITIES! RISK/THREAT DETECTION AREAS! Peter and Sam access a malicious website. A backdoor gets installed on their computers! Malicious Domain (AGD)! Unusual Browser Header!Nov 15! Unusual Machine Access for Peter! (lateral movement; individual + peer group)!Dec 10!The attacker logs on to Domain Controller via VPN with Peter’s stolen credentials from 1.0.63.14 ! Unusual Browser Header for Peter and Sam!Nov 16! The attacker uses Peter and Sam’s backdoors to download and execute WCE to crack their password! Nov 16! Beacons for Peter and Sam to www.byeigs.ddns.com! Peter and Sam’s machines are communicating with www.byeigs.ddns.info! Unusual Machine Access for Sam! Unusual File Access for Sam ! (individual + peer group))! Dec 10! The attacker logs in as Sam and accesses all excel and negotiations docs on the BizDev shares! Unusual Activity Sequence of Admin for Sam (AD/DC Privilege Escalation)!Dec 10! The attacker steals the admin Kerberos ticket from admin account and escalates the privileges for Sam.! Excessive Data Transmission for Peter" Unusual VPN session duration!Jan 14!The attacker VPNs as Peter, copies the docs to an external staging IP and then logs out after 3 hours.!
25   Splunk  User  Behavior  Analy8cs  (formerly  Caspida)   Advanced  Security  Analy0cs   UBA  SPLUNK   Data  Science  &   Decision  Engine   Automated  Threat   Detec>on   AD,  SSO   App,  DB  logs   Firewall,  IPS,   DLP   Ne[low,   PCAP   Threat  Feeds   UBA  threat  results  fed  into  Splunk  ES   Security  Analy8cs  &   Event  Repository  
26  
27  
28  
News  in  ES  4.0   29  
30   New  Features  in  Enterprise  Security  4.0   Optimize multi-step analyses to improve breach detection and response Extensible Analytics & Collaboration INVESTIGATION   COLLABORATION   •  Inves>gator  Journal   •  ACack  &  Inves>ga>on  Timeline   •  Open  Solu>ons  Framework   •  Framework  App  :  PCI  
31   ACack  &  Inves>ga>on  Timeline   Same  events  can  have  different  security  meanings,  based  on  sequence:   31   Track Actions 1" 3"2" Analyst / Investigator Event 1 … 13:01:21 Event 2 … 13:42:17 Action 3 Note “Windows event” What happened? If event 1, then event 2, then… Ah – ha, that’s how they got in. Now what infected the host? Brut  Force   = Exfiltration Login  Failure   Proxy  Event   Brut  Force   = Recon, Lateral Movement Login  Failure   Login  Failure   Brut  Force   = Forgotten Password
32   ACack  &  Inves>ga>on  Timeline   Methods  to  add  contents  into  >meline  :   32   Action History Actions : •  Search Run •  Dashboard Viewed •  Panel Filtered •  Notable Status Change •  Notable Event Suppressed Investigator Memo Notes: Investigator’s notes inserted in timeline Track Actions 1" 3"2" Incident Review Incident : Notable events from Incident Review Analyst / Investigator
33   ACack  &  Inves>ga>on  Timeline   Allows  collabora>on  between  mul>ple  analysts   33   UI Action History : Search UI Action History : Viewed Dashboard Edit Entry : Analyst’s Memo Collaborator entry Tier 1 Tier 2 Analyst Tier 2 Analyst Collaborate One Holistic view from Collective Knowledge
34   Inves>gator  Journal  -­‐  Flow   Solution •  Track searches and activities to help them understand actions taken and information seen •  Review activities at any point in the investigation Action History Action History History includes all the investigative actions that analysts have taken in the Splunk ES interface Ad-hoc analysis Hunting Triage / Investigation Track Actions 1" 3"2" User Analysis Actions Problem •  Analyst searches / views / actions are difficult to track and require multiple tools Analysis Sequence History 34  
35   Inves>gator  Journal  –  Details   •  Streamlines multi-step analyses and investigations –  Track searches and activities –  Review activities at any point –  Select and place into timeline for temporal analysis –  Help remember searches, steps taken, provide annotation support 35   Track Actions 1" 3"2" Action History
36   Open  Solu>ons  Framework   Supports critical security related management framework features 36   Enterprise Security Framework •  Notable Events Framework •  Thereat Intelligence Framework •  Risk Scoring Framework •  Identity & Asset Framework Customer Apps APPs / Contents Partner Apps APPs / Contents Splunk Apps APPs / Contents •  Export •  Import •  Share Collaborate •  Summarization Framework •  Alerting & Scheduling •  Visualization Framework •  Application Framework External" Instance
37   Extensible  Analy>cs  &  Collabora>on   Open Solutions Framework •  Create, access and extend ES functionality –  Notable event framework –  Risk framework –  Threat intelligence framework –  Identity & asset framework •  Apps and content can be imported and exported at any time 37   Collaborate
38   UBA  vs  ES  4.0   UBA  Enterprise  Security   •  Keep  all  data   •  Will  require  tuning   •  Easy  to  create  new  searches,   dashboards,  correla>ons  etc   •  Will  require  analy>c  resources  to   map  events  to  threats   •  Possible  to  further  inves>gate     •  Only  keep  data  around  anomaly   •  Automa>cally  baseline   •  Not  possible  to  customize  in  the  same   way  as  Enterprise  Security   •  Will  map  anomalies  to  threats   •  Limited  possibility  to  do  further   inves>ga>on   38  
39   Key  takeaways   •  Preven>on  of  breaches  will  fail!   •  Invest  more  in  detec>on   •  Splunk  can  help   –  Faster   –  Easier   –  More   –  Less  labor   39  
Thank  You  

Recommended

Gov Day Sacramento 2015 - User Behavior Analytics
Gov Day Sacramento 2015 - User Behavior AnalyticsGov Day Sacramento 2015 - User Behavior Analytics
Gov Day Sacramento 2015 - User Behavior AnalyticsSplunk
 
Splunk for Security
Splunk for SecuritySplunk for Security
Splunk for SecurityGabrielle Knowles
 
Gov & Education Day 2015 - User Behavior Analytics
Gov & Education Day 2015 - User Behavior AnalyticsGov & Education Day 2015 - User Behavior Analytics
Gov & Education Day 2015 - User Behavior AnalyticsSplunk
 
SplunkSummit 2015 - Splunk User Behavioral Analytics
SplunkSummit 2015 - Splunk User Behavioral AnalyticsSplunkSummit 2015 - Splunk User Behavioral Analytics
SplunkSummit 2015 - Splunk User Behavioral AnalyticsSplunk
 
Enterprise Sec + User Bahavior Analytics
Enterprise Sec + User Bahavior AnalyticsEnterprise Sec + User Bahavior Analytics
Enterprise Sec + User Bahavior AnalyticsSplunk
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Splunk
 
SplunkLive! Splunk for Insider Threats and Fraud Detection
SplunkLive! Splunk for Insider Threats and Fraud DetectionSplunkLive! Splunk for Insider Threats and Fraud Detection
SplunkLive! Splunk for Insider Threats and Fraud DetectionSplunk
 
SplunkLive! Splunk for Security
SplunkLive! Splunk for SecuritySplunkLive! Splunk for Security
SplunkLive! Splunk for SecuritySplunk
 

Recommended

Gov Day Sacramento 2015 - User Behavior Analytics
Gov Day Sacramento 2015 - User Behavior AnalyticsGov Day Sacramento 2015 - User Behavior Analytics
Gov Day Sacramento 2015 - User Behavior AnalyticsSplunk
 
Splunk for Security
Splunk for SecuritySplunk for Security
Splunk for SecurityGabrielle Knowles
 
Gov & Education Day 2015 - User Behavior Analytics
Gov & Education Day 2015 - User Behavior AnalyticsGov & Education Day 2015 - User Behavior Analytics
Gov & Education Day 2015 - User Behavior AnalyticsSplunk
 
SplunkSummit 2015 - Splunk User Behavioral Analytics
SplunkSummit 2015 - Splunk User Behavioral AnalyticsSplunkSummit 2015 - Splunk User Behavioral Analytics
SplunkSummit 2015 - Splunk User Behavioral AnalyticsSplunk
 
Enterprise Sec + User Bahavior Analytics
Enterprise Sec + User Bahavior AnalyticsEnterprise Sec + User Bahavior Analytics
Enterprise Sec + User Bahavior AnalyticsSplunk
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Splunk
 
SplunkLive! Splunk for Insider Threats and Fraud Detection
SplunkLive! Splunk for Insider Threats and Fraud DetectionSplunkLive! Splunk for Insider Threats and Fraud Detection
SplunkLive! Splunk for Insider Threats and Fraud DetectionSplunk
 
SplunkLive! Splunk for Security
SplunkLive! Splunk for SecuritySplunkLive! Splunk for Security
SplunkLive! Splunk for SecuritySplunk
 
Splunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case StudySplunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case StudyAndrew Gerber
 
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk ScoringSplunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk ScoringSplunk
 
Using Splunk for Information Security
Using Splunk for Information SecurityUsing Splunk for Information Security
Using Splunk for Information SecurityShannon Cuthbertson
 
Splunk for Security - Hands-On
Splunk for Security - Hands-On Splunk for Security - Hands-On
Splunk for Security - Hands-On Splunk
 
Splunk for Security-Hands On
Splunk for Security-Hands OnSplunk for Security-Hands On
Splunk for Security-Hands OnSplunk
 
User Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To CompaniesUser Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To CompaniesSpectorsoft
 
Splunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at IntuitSplunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at IntuitErin Sweeney
 
Using Big Data for Cybersecurity
Using Big Data for CybersecurityUsing Big Data for Cybersecurity
Using Big Data for CybersecuritySplunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk
 
Splunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk
 
Hands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided TourHands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided TourSplunk
 
Enterprise Security and User Behavior Analytics
Enterprise Security and User Behavior AnalyticsEnterprise Security and User Behavior Analytics
Enterprise Security and User Behavior AnalyticsSplunk
 
Enterprise Security featuring UBA
Enterprise Security featuring UBAEnterprise Security featuring UBA
Enterprise Security featuring UBASplunk
 
Webinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise SecurityWebinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise SecurityGeorg Knon
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für SecuritySplunk
 
SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop Splunk
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple TeamPriyanka Aash
 
The Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch SystemThe Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch SystemLancope, Inc.
 
SplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunk
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security IntelligenceSplunk
 
SplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunk
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security IntelligenceSplunk
 

More Related Content

What's hot

Splunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case StudySplunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case StudyAndrew Gerber
 
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk ScoringSplunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk ScoringSplunk
 
Using Splunk for Information Security
Using Splunk for Information SecurityUsing Splunk for Information Security
Using Splunk for Information SecurityShannon Cuthbertson
 
Splunk for Security - Hands-On
Splunk for Security - Hands-On Splunk for Security - Hands-On
Splunk for Security - Hands-On Splunk
 
Splunk for Security-Hands On
Splunk for Security-Hands OnSplunk for Security-Hands On
Splunk for Security-Hands OnSplunk
 
User Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To CompaniesUser Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To CompaniesSpectorsoft
 
Splunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at IntuitSplunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at IntuitErin Sweeney
 
Using Big Data for Cybersecurity
Using Big Data for CybersecurityUsing Big Data for Cybersecurity
Using Big Data for CybersecuritySplunk
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk
 
Splunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk
 
Hands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided TourHands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided TourSplunk
 
Enterprise Security and User Behavior Analytics
Enterprise Security and User Behavior AnalyticsEnterprise Security and User Behavior Analytics
Enterprise Security and User Behavior AnalyticsSplunk
 
Enterprise Security featuring UBA
Enterprise Security featuring UBAEnterprise Security featuring UBA
Enterprise Security featuring UBASplunk
 
Webinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise SecurityWebinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise SecurityGeorg Knon
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für SecuritySplunk
 
SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop Splunk
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple TeamPriyanka Aash
 
The Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch SystemThe Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch SystemLancope, Inc.
 
SplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunk
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security IntelligenceSplunk
 

What's hot (20)

Splunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case StudySplunk for Security: Background & Customer Case Study
Splunk for Security: Background & Customer Case Study
 
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk ScoringSplunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
Splunk conf2014 - Detecting Fraud and Suspicious Events Using Risk Scoring
 
Using Splunk for Information Security
Using Splunk for Information SecurityUsing Splunk for Information Security
Using Splunk for Information Security
 
Splunk for Security - Hands-On
Splunk for Security - Hands-On Splunk for Security - Hands-On
Splunk for Security - Hands-On
 
Splunk for Security-Hands On
Splunk for Security-Hands OnSplunk for Security-Hands On
Splunk for Security-Hands On
 
User Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To CompaniesUser Behavior Analytics And The Benefits To Companies
User Behavior Analytics And The Benefits To Companies
 
Splunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at IntuitSplunk .conf2011: Splunk for Fraud and Forensics at Intuit
Splunk .conf2011: Splunk for Fraud and Forensics at Intuit
 
Using Big Data for Cybersecurity
Using Big Data for CybersecurityUsing Big Data for Cybersecurity
Using Big Data for Cybersecurity
 
Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics Splunk for Enterprise Security featuring User Behavior Analytics
Splunk for Enterprise Security featuring User Behavior Analytics
 
Splunk for Security Breakout Session
Splunk for Security Breakout SessionSplunk for Security Breakout Session
Splunk for Security Breakout Session
 
Hands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided TourHands-On Security Breakout Session- ES Guided Tour
Hands-On Security Breakout Session- ES Guided Tour
 
Enterprise Security and User Behavior Analytics
Enterprise Security and User Behavior AnalyticsEnterprise Security and User Behavior Analytics
Enterprise Security and User Behavior Analytics
 
Enterprise Security featuring UBA
Enterprise Security featuring UBAEnterprise Security featuring UBA
Enterprise Security featuring UBA
 
Webinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise SecurityWebinar: Neues zur Splunk App for Enterprise Security
Webinar: Neues zur Splunk App for Enterprise Security
 
Splunk für Security
Splunk für SecuritySplunk für Security
Splunk für Security
 
SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop SplunkSummit 2015 - ES Hands On Workshop
SplunkSummit 2015 - ES Hands On Workshop
 
The Rise of the Purple Team
The Rise of the Purple TeamThe Rise of the Purple Team
The Rise of the Purple Team
 
The Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch SystemThe Critical Security Controls and the StealthWatch System
The Critical Security Controls and the StealthWatch System
 
SplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary SessionSplunkLive! Milano 2016 - Splunk Plenary Session
SplunkLive! Milano 2016 - Splunk Plenary Session
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security Intelligence
 

Similar to SplunkLive! Stockholm 2015 breakout - Analytics based security

SplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunk
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security IntelligenceSplunk
 
SplunkLive Auckland 2015 - Splunk for Security
SplunkLive Auckland 2015 - Splunk for SecuritySplunkLive Auckland 2015 - Splunk for Security
SplunkLive Auckland 2015 - Splunk for SecuritySplunk
 
SplunkLive Wellington 2015 - Splunk for Security
SplunkLive Wellington 2015 - Splunk for SecuritySplunkLive Wellington 2015 - Splunk for Security
SplunkLive Wellington 2015 - Splunk for SecuritySplunk
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session Splunk
 
Using Big Data to Counteract Advanced Threats
Using Big Data to Counteract Advanced ThreatsUsing Big Data to Counteract Advanced Threats
Using Big Data to Counteract Advanced ThreatsZivaro Inc
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
Hands on Security - Disrupting the Kill Chain Breakout Session
Hands on Security - Disrupting the Kill Chain Breakout SessionHands on Security - Disrupting the Kill Chain Breakout Session
Hands on Security - Disrupting the Kill Chain Breakout SessionSplunk
 
Hands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainHands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainSplunk
 
Hands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainHands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainSplunk
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with SplunkSplunk
 
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your Risk
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your RiskHow to Access and Make Use of “Trapped” Cyber Data to Reduce Your Risk
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your RiskSurfWatch Labs
 
Solvay secure application layer v2015 seba
Solvay secure application layer v2015 sebaSolvay secure application layer v2015 seba
Solvay secure application layer v2015 sebaSebastien Deleersnyder
 
SplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunk
 
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2Damir Delija
 
Using Splunk for Information Security
Using Splunk for Information SecurityUsing Splunk for Information Security
Using Splunk for Information SecuritySplunk
 
Splunk for Security Workshop
Splunk for Security WorkshopSplunk for Security Workshop
Splunk for Security WorkshopSplunk
 
FireSIGHT Management Center (FMC) slides
FireSIGHT Management Center (FMC) slidesFireSIGHT Management Center (FMC) slides
FireSIGHT Management Center (FMC) slidesAmy Gerrie
 

Similar to SplunkLive! Stockholm 2015 breakout - Analytics based security (20)

SplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakoutSplunkLive! Amsterdam 2015 - Analytics based security breakout
SplunkLive! Amsterdam 2015 - Analytics based security breakout
 
Operational Security Intelligence
Operational Security IntelligenceOperational Security Intelligence
Operational Security Intelligence
 
SplunkLive Auckland 2015 - Splunk for Security
SplunkLive Auckland 2015 - Splunk for SecuritySplunkLive Auckland 2015 - Splunk for Security
SplunkLive Auckland 2015 - Splunk for Security
 
SplunkLive Wellington 2015 - Splunk for Security
SplunkLive Wellington 2015 - Splunk for SecuritySplunkLive Wellington 2015 - Splunk for Security
SplunkLive Wellington 2015 - Splunk for Security
 
Security Breakout Session
Security Breakout Session Security Breakout Session
Security Breakout Session
 
Using Big Data to Counteract Advanced Threats
Using Big Data to Counteract Advanced ThreatsUsing Big Data to Counteract Advanced Threats
Using Big Data to Counteract Advanced Threats
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
Hands on Security - Disrupting the Kill Chain Breakout Session
Hands on Security - Disrupting the Kill Chain Breakout SessionHands on Security - Disrupting the Kill Chain Breakout Session
Hands on Security - Disrupting the Kill Chain Breakout Session
 
Hands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainHands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill Chain
 
Hands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill ChainHands-On Security Breakout Session- Disrupting the Kill Chain
Hands-On Security Breakout Session- Disrupting the Kill Chain
 
Threat Hunting with Splunk
Threat Hunting with Splunk Threat Hunting with Splunk
Threat Hunting with Splunk
 
Threat Hunting with Splunk
Threat Hunting with SplunkThreat Hunting with Splunk
Threat Hunting with Splunk
 
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your Risk
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your RiskHow to Access and Make Use of “Trapped” Cyber Data to Reduce Your Risk
How to Access and Make Use of “Trapped” Cyber Data to Reduce Your Risk
 
Solvay secure application layer v2015 seba
Solvay secure application layer v2015 sebaSolvay secure application layer v2015 seba
Solvay secure application layer v2015 seba
 
SplunkLive! - Splunk for Security
SplunkLive! - Splunk for SecuritySplunkLive! - Splunk for Security
SplunkLive! - Splunk for Security
 
Cybersecurity - Jim Butterworth
Cybersecurity - Jim ButterworthCybersecurity - Jim Butterworth
Cybersecurity - Jim Butterworth
 
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2
Encase cybersecurity alat za proaktivnu kontrolu korporativne it sigurnosti 2
 
Using Splunk for Information Security
Using Splunk for Information SecurityUsing Splunk for Information Security
Using Splunk for Information Security
 
Splunk for Security Workshop
Splunk for Security WorkshopSplunk for Security Workshop
Splunk for Security Workshop
 
FireSIGHT Management Center (FMC) slides
FireSIGHT Management Center (FMC) slidesFireSIGHT Management Center (FMC) slides
FireSIGHT Management Center (FMC) slides
 

More from Splunk

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routineSplunk
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTVSplunk
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)Splunk
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank InternationalSplunk
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett Splunk
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)Splunk
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...Splunk
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...Splunk
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)Splunk
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)Splunk
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk
 
Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College LondonSplunk
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSplunk
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability SessionSplunk
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - KeynoteSplunk
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform SessionSplunk
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security SessionSplunk
 

More from Splunk (20)

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11y
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go Köln
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go Köln
 
Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security Webinar
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session
 

Recently uploaded

Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreternaman860154
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?Antenna Manufacturer Coco
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Enterprise Knowledge
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 

Recently uploaded (20)

Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Presentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreterPresentation on how to chat with PDF using ChatGPT code interpreter
Presentation on how to chat with PDF using ChatGPT code interpreter
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 

SplunkLive! Stockholm 2015 breakout - Analytics based security

  • 1. Copyright  ©  2015  Splunk  Inc.   Splunk  for  Security  –  AKA   Analy>cs  based  security   Niklas  Blomquist   SME  Security  
  • 2. 2   Agenda   •  Advanced  aCacks  are  hard  to  find   •  How  to  use  Splunk  for  Security   •  Most  common  use-­‐cases   •  How  to  add  value  to  exis>ng  data   •  How  to  detect  new  threats   •  User  Behavior  Analy>cs   •  News  in  ES  4.0  
  • 3. Advanced  Threats  Are  Hard  to  Find   Cyber  Criminals     Na8on  States     Insider  Threats     Source:  Mandiant  M-­‐Trends  Report   100%    Valid  creden>als  were  used   40     Average  #  of  systems  accessed   205   Median  #  of  days  before  detec>on   67%   Of  vic>ms  were  no>fied  by   external  en>ty  
  • 4. 4   Tradi>onal  approaches  are  not  good  enough   •  Preven>on  of  breaches  will  fail!   •  Invest  more  in  detec>on   •  Gather  all  data  in  one  place   •  Enrich  data  with  context   •  Make  it  easy  to  search  in  the  data   •  Make  it  easy  to  do  advanced  analy>cs   4  
  • 5. 5   SPLUNK FOR SECURITY “Connects People and Data with Context and Extended Intelligence”
  • 6. 6   Monitoring,   Correla8ons,   Alerts   Ad  Hoc     Search  &   Inves8gate   Custom     Dashboards   And  Reports   Analy8cs  And   Visualiza8on   Developer   PlaQorm   All  SOC  Needs  &  Personnel   Security  Intelligence  Pla[orm   6       Real-­‐8me   Machine  Data   Cloud     Apps   Servers   Email   Web   Network   Flows   DHCP/  DNS   Custom   Apps   Badges   Intrusion     Detec>on   Firewall   Data  Loss   Preven>on   An>-­‐Malware   Vulnerability   Scans   Authen>ca>on   Storage   Industrial   Control   Mobile   Security  Intelligence  PlaQorm   Threat   Feeds   Asset     Info   Employee   Info   Data   Stores   Applica8ons   External  Lookups  /  Enrichment  
  • 7. 7   Enables  Many  Security  Use  Cases     SECURITY  &                     COMPLIANCE   REPORTING   REAL-­‐TIME   MONITORING  OF   KNOWN  THREATS   DETECTING     UNKNOWN   THREATS   INCIDENT   INVESTIGATIONS   &  FORENSICS   FRAUD     DETECTION   INSIDER     THREAT   Security  Intelligence  PlaQorm   7  
  • 8. Add  value  to  exis>ng  data  
  • 9. 9   A  fire!   Is  there  a  real  danger?  
  • 10. 10   Adding  context   BBQ  vs  house  on  fire  
  • 11. 11   Context  =  knowledge  around  the  data   "   Importance  of  assets  and  iden>>es   "   Is  this  a  bad  know  ip/domain/e-­‐mail   "   Should  user  access  the  SQL  server   "   Should  server  communicate  X   "   Make  data  easier  to  understand  
  • 12. 12   Data  from  An>-­‐Virus/An>-­‐Malware   "   No  need  to  act  if  removed   "   But  what  if;   –  The  hosts  are  re-­‐infected?   –  Mul>ple  hosts  are  infected  in  short  >me   –  If  the  CEO/CFO/CSIO  computer  are  infected?   –  Host  are  the  webshop/Internetbank/important  system   –  Other  sources  alerts  within  short  >meframe     12  
  • 13. 13  
  • 14. 14   Alerts  on  most  cri>cal  events  
  • 15. 15   Inves>gate  the  incident  
  • 16. 16   Visual  Inves>ga>ons  for  All  Users  
  • 17. How  to  find  new  threats   17  
  • 18. Threat  intelligence   Auth  -­‐  User  Roles,   Corp  Context   Host     Ac8vity/Security   Network     Ac8vity/Security   18   Advanced  Threat  Detec>on  &  Response   WEB   Conduct   Business   Create  addi8onal   environment   Gain  Access     to  system  Transac8on   MAIL   .pdf   Svchost.exe  Calc.exe   Events  that     contain  link  to  file   Proxy  log   C2  communica>on     to  blacklist   How  was     process  started?   What  created  the   program/process?   Process  making   C2  traffic   Web   Portal  .pdf  
  • 19. Threat  intelligence   Auth  -­‐  User  Roles,   Corp  Context   Host     Ac8vity/Security   Network     Ac8vity/Security   Command  &  Control  Exploita8on  &  Installa8on  Delivery   MAIL   WEB   WEB   FW   Accomplish  Mission       Start  Anywhere,  Analyze  Up-­‐Down-­‐Across-­‐Backwards-­‐Forward   phishing   Download   from   infected  site   1   2   5   6   7   8   3   4   Iden>ty,  Roles,  Privileges,  Loca>on,  Behavior,  Risk,  Audit  scope,  Classifica>on,  etc.     •  Third-­‐Party  Threat  Intel   •  Open  source  blacklist   •  Internal  threat  intelligence   •  Firewall   •  IDS  /  IPS   •  Vulnerability  scanners   •  Web  Proxy   •  NetFlow   •  Network   •  Endpoint  (AV/IPS/FW)   •  Malware  detec>on   •  PCLM   •  DHCP   •  OS  logs   •  Patching   •  Ac>ve  Directory   •  LDAP   •  CMDB   •  Opera>ng  System   •  Database   •  VPN,  AAA,  SSO  
  • 20. Copyright  ©  2015  Splunk  Inc.   Splunk  User   Behavior  Analy8cs   (UBA)     Powered  by  Caspida  
  • 21. Tradi8onal  SIEM   SIGNATURES   RULES   HUMAN     ANALYSIS  
  • 22. DATA-­‐SCIENCE  DRIVEN   BEHAVIORAL  ANALYTICS   BIG  DATA     DRIVEN   SECURITY   ANALYTICS   MACHINE   LEARNING   A  NEW  PARADIGM  
  • 23. 23   MAPPING  RATs     TO       ACTIONABLE  KILL-­‐CHAIN   A W N O M A L I E S H R E A T
  • 24. 24   CYBER  ATTACK   24   USER ACTIVITIES! RISK/THREAT DETECTION AREAS! Peter and Sam access a malicious website. A backdoor gets installed on their computers! Malicious Domain (AGD)! Unusual Browser Header!Nov 15! Unusual Machine Access for Peter! (lateral movement; individual + peer group)!Dec 10!The attacker logs on to Domain Controller via VPN with Peter’s stolen credentials from 1.0.63.14 ! Unusual Browser Header for Peter and Sam!Nov 16! The attacker uses Peter and Sam’s backdoors to download and execute WCE to crack their password! Nov 16! Beacons for Peter and Sam to www.byeigs.ddns.com! Peter and Sam’s machines are communicating with www.byeigs.ddns.info! Unusual Machine Access for Sam! Unusual File Access for Sam ! (individual + peer group))! Dec 10! The attacker logs in as Sam and accesses all excel and negotiations docs on the BizDev shares! Unusual Activity Sequence of Admin for Sam (AD/DC Privilege Escalation)!Dec 10! The attacker steals the admin Kerberos ticket from admin account and escalates the privileges for Sam.! Excessive Data Transmission for Peter" Unusual VPN session duration!Jan 14!The attacker VPNs as Peter, copies the docs to an external staging IP and then logs out after 3 hours.!
  • 25. 25   Splunk  User  Behavior  Analy8cs  (formerly  Caspida)   Advanced  Security  Analy0cs   UBA  SPLUNK   Data  Science  &   Decision  Engine   Automated  Threat   Detec>on   AD,  SSO   App,  DB  logs   Firewall,  IPS,   DLP   Ne[low,   PCAP   Threat  Feeds   UBA  threat  results  fed  into  Splunk  ES   Security  Analy8cs  &   Event  Repository  
  • 26. 26  
  • 27. 27  
  • 28. 28  
  • 29. News  in  ES  4.0   29  
  • 30. 30   New  Features  in  Enterprise  Security  4.0   Optimize multi-step analyses to improve breach detection and response Extensible Analytics & Collaboration INVESTIGATION   COLLABORATION   •  Inves>gator  Journal   •  ACack  &  Inves>ga>on  Timeline   •  Open  Solu>ons  Framework   •  Framework  App  :  PCI  
  • 31. 31   ACack  &  Inves>ga>on  Timeline   Same  events  can  have  different  security  meanings,  based  on  sequence:   31   Track Actions 1" 3"2" Analyst / Investigator Event 1 … 13:01:21 Event 2 … 13:42:17 Action 3 Note “Windows event” What happened? If event 1, then event 2, then… Ah – ha, that’s how they got in. Now what infected the host? Brut  Force   = Exfiltration Login  Failure   Proxy  Event   Brut  Force   = Recon, Lateral Movement Login  Failure   Login  Failure   Brut  Force   = Forgotten Password
  • 32. 32   ACack  &  Inves>ga>on  Timeline   Methods  to  add  contents  into  >meline  :   32   Action History Actions : •  Search Run •  Dashboard Viewed •  Panel Filtered •  Notable Status Change •  Notable Event Suppressed Investigator Memo Notes: Investigator’s notes inserted in timeline Track Actions 1" 3"2" Incident Review Incident : Notable events from Incident Review Analyst / Investigator
  • 33. 33   ACack  &  Inves>ga>on  Timeline   Allows  collabora>on  between  mul>ple  analysts   33   UI Action History : Search UI Action History : Viewed Dashboard Edit Entry : Analyst’s Memo Collaborator entry Tier 1 Tier 2 Analyst Tier 2 Analyst Collaborate One Holistic view from Collective Knowledge
  • 34. 34   Inves>gator  Journal  -­‐  Flow   Solution •  Track searches and activities to help them understand actions taken and information seen •  Review activities at any point in the investigation Action History Action History History includes all the investigative actions that analysts have taken in the Splunk ES interface Ad-hoc analysis Hunting Triage / Investigation Track Actions 1" 3"2" User Analysis Actions Problem •  Analyst searches / views / actions are difficult to track and require multiple tools Analysis Sequence History 34  
  • 35. 35   Inves>gator  Journal  –  Details   •  Streamlines multi-step analyses and investigations –  Track searches and activities –  Review activities at any point –  Select and place into timeline for temporal analysis –  Help remember searches, steps taken, provide annotation support 35   Track Actions 1" 3"2" Action History
  • 36. 36   Open  Solu>ons  Framework   Supports critical security related management framework features 36   Enterprise Security Framework •  Notable Events Framework •  Thereat Intelligence Framework •  Risk Scoring Framework •  Identity & Asset Framework Customer Apps APPs / Contents Partner Apps APPs / Contents Splunk Apps APPs / Contents •  Export •  Import •  Share Collaborate •  Summarization Framework •  Alerting & Scheduling •  Visualization Framework •  Application Framework External" Instance
  • 37. 37   Extensible  Analy>cs  &  Collabora>on   Open Solutions Framework •  Create, access and extend ES functionality –  Notable event framework –  Risk framework –  Threat intelligence framework –  Identity & asset framework •  Apps and content can be imported and exported at any time 37   Collaborate
  • 38. 38   UBA  vs  ES  4.0   UBA  Enterprise  Security   •  Keep  all  data   •  Will  require  tuning   •  Easy  to  create  new  searches,   dashboards,  correla>ons  etc   •  Will  require  analy>c  resources  to   map  events  to  threats   •  Possible  to  further  inves>gate     •  Only  keep  data  around  anomaly   •  Automa>cally  baseline   •  Not  possible  to  customize  in  the  same   way  as  Enterprise  Security   •  Will  map  anomalies  to  threats   •  Limited  possibility  to  do  further   inves>ga>on   38  
  • 39. 39   Key  takeaways   •  Preven>on  of  breaches  will  fail!   •  Invest  more  in  detec>on   •  Splunk  can  help   –  Faster   –  Easier   –  More   –  Less  labor   39