SplunkLive! Munich 2018: Intro to Security Analytics Methods
Download as PPTX, PDF2 likes526 views
The document provides an introduction and agenda for a presentation on security analytics methods. The agenda includes an intro to analytics methods from 11:40-12:40 followed by a lunch break from 12:40-13:40. The presentation may include forward-looking statements and disclaimers are provided. Information presented is subject to change and any information about product roadmaps is for informational purposes only.
Ad
More Related Content
What's hot (20)
Similar to SplunkLive! Munich 2018: Intro to Security Analytics Methods (20)
Ad
More from Splunk (20)
Ad
Recently uploaded (20)
SplunkLive! Munich 2018: Intro to Security Analytics Methods
- 1. Intro to Security Analytics Methods 11:40 – 12:40 Danach Mittagspause 12:40 – 13:40
- 2. During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC. The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release. Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. ©2018 Splunk Inc. All rights reserved. Forward-Looking Statements
- 3. Joachim Gebauer Senior Sales Engineer | CISM | CISSP SME for Security [email protected] +49 162 4344246 Personal Introduction 3
- 4. © 2018 SPLUNK INC. 1. Intro to Analytics Methods 2. Example Scenario 3. Next Steps Agenda 4
- 6. First Time Seen powered by stats Time Series Analysis with Standard Deviation General Security Analytics Searches Analytics Methods Types of Use Cases
- 7. Applying to Stages of an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 8. Detection of Suspicious Email Activity
- 9. Applying to Stages of an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 11. Applying to Stages of an Attack HTTP (web) session to command & control server Remote control, Steal data, Persist in company, Rent as botnet WEB .pdf .pdf executes & unpacks malware overwriting and running “allowed” programs Svchost.exeCalc.exe Attacker hacks website Steals .pdf files Web Portal Attacker creates malware, embed in .pdf, Emails to the target MAIL Read email, open attachment Threat intelligence Auth - User Roles Host Activity/Security Network Activity/Security
- 12. Identifying Exfiltration and/or Command and Control
- 13. Implementation Approach for Security Analytics Alert Aggregation AlertCreation Investigation Investigative Platform • Analyst flexibility • Provide access to data analysis solutions • Record historical context for everything Simpler Detection • Rules and statistics • Quick development • Easy for analysts ML Based Detection • Detect unknown • New vectors • Heavy data science Threat Detection • Manage high volume • Track entity relationships • Combination ML + Rules
- 14. The Splunk Portfolio Rich Ecosystem of Apps & Add-Ons Splunk Premium Solutions Mainframe Data Relational Databases MobileForwarders Syslog/ TCP IoT Devices Network Wire Data Hadoop Platform for Operational Intelligence
- 15. Slow Response from Basic Alerts Fast Response from Advanced Alerts Managing Alert Volume vs Value Use Low Volume Searches Splunk ES Risk Framework Splunk UBA Threat Models UBA + ES Adaptive Response
- 16. Use Low Volume Searches Splunk ES Risk Framework Splunk UBA Threat Models UBA + ES Adaptive Response Managing Alert Volume vs Value Everyone starts here, and spends most of their time here
- 17. ▶ Enterprise Security has a Risk Framework designed for aggregating low severity indicators Aggregate Alerting with ES Risk
- 18. ▶ High Confidence alerts from UBA fed into ES ▶ Take actions like • Box: “Change Permissions” • AD: “Reset Password” or “Disable Account” • PAN: Isolate Host ▶ 40+ partners! Respond With ES Adaptive Response
- 19. ▶ Splunk UBA Threat Models leverage Data Science, Machine Learning ▶ Finds important, inter-related anomalies that analysts should actually view ▶ Support more advanced anomaly detections! Apply Machine Learning With Splunk UBA
- 21. Download Splunk Security Essentials
- 22. Where Can I Install Splunk Security Essentials? Survey Results: Have You Tried to Install the App? Tried and Failed Installed in Dev Installed in Production Installed in Distributed Environment Installed in a SHC Environment Your Laptop! Your Production Environtment! All Kinds of Production Environtments! Your Dev Environment!
- 23. ▶ You can think about operational maturity in terms of data ▶ Start with the basics – get your data into a single location ▶ Then work your way up the stack ▶ Not sure how to start? Yes, there is an app for that Looking at Security in Terms of Data
- 24. ▶ Identify bad guys: • 300+ security analytics methods • Target external and insider threats • Scales from small to massive companies • Save from app, send hits to ES/UBA Splunk Security Essentials https://splunkbase.splunk.com/app/3435/ Solve use cases you can today for free, then use Splunk UBA for advanced ML detection.
- 25. • Access • Data • Endpoint • Network • Threat • Any Host Logs • Electronic Medical Record System • Email Logs • Firewall • Netflow • Print Server Logs • Very Low • Low • Medium • High • Very High Splunk Security Essentials App Inventory “Say, aren’t those all recommended data sources for Splunk Security in general?” DOMAINS DATA SOURCES ALERT VOLUME • Salesforce Event Log File • Source Code Repository Logs • Splunk Notable Events
- 26. Splunk Security Essentials Demo
- 27. ▶ Download from apps.splunk.com ▶ Browse use cases that match your needs ▶ Data Source Check shows other use cases for your existing data ▶ Evaluate free tools to meet gaps, such as Microsoft Sysmon • (links inside the app) Getting Started with Splunk Security Essentials
- 28. Open the Splunk Security Essentials App First Open Splunk Security Essentials Then Open Use Cases
- 29. ▶ Read through a few of the use cases ▶ Filter for use cases you care about Take a Minute to Review Use Cases
- 30. Let’s Start With a Simple Example Click on “Concentration of Hacker Tools by Filename”
- 31. ▶ A search you might not think of, but is easy to use ▶ Input: CSV file with suspicious filenames ▶ Input: Process launch logs (Windows, Sysmon, Carbon Black, etc.) ▶ Looks for those file names concentrated in a short period of time Concentration of Hacker Tools by Filename
- 32. Applying to Live Data Click Live Data See a Live Search
- 33. ▶ Phishing is a big risk ▶ Many approaches to mitigating with Splunk An Advanced Splunk Search From Data Sources, Filter to Email Logs Click on ‘Emails with Lookalike Domains’ From Journey Select Stage 4
- 34. ▶ A very long search you don’t have to run ▶ Detects typos, like company.com → campany.com ▶ Supports subdomains for typo detection ▶ Detects suspicious subdomains, like company.com → company.yourithelpdesk.com A Phishing Search Larger Than Your Pond
- 35. Demo Scenario
- 36. ▶ Actor: Malicious Insider (because it’s hardest) ▶ Motivation: Going to work for competitor ▶ Target: Accounts, Opportunities, Contacts in Salesforce ▶ Additional Target: Sales Proposals in Box ▶ Exfiltration: Upload to a remote server Apply Splunk to Real Life Scenario Malicious Insider Chris Geremy Director of Finance * Photo of Splunker, I promise she is not a malicious insider
- 37. ▶ No proxy ▶ No standard file servers ▶ No agents on laptop ▶ Cloud Services with their own APIs How would you detect that? Monitoring Challenges
- 38. ▶ Ingest Salesforce Event Log File • https://splunkbase.splunk.com/app/1931/ ▶ Ingest Box Data • https://splunkbase.splunk.com/app/2679/ ▶ Install Splunk Security Essentials • https://splunkbase.splunk.com/app/3435/ ▶ Schedule Salesforce use cases ▶ Build a custom Box use case Set Up Monitoring About 1 Hour of Work
- 39. ▶ Do you want to build your own detections like this? ▶ What if your environment is totally custom? ▶ No product has ever worked out of the box, and that’s why you like Splunk, right? We’ve got you. But My Company Is So Custom Click Assistants, then “Detect Spikes”
- 40. © 2018 SPLUNK INC. Use Case Our Malicious Insider, Jane Smith, also downloaded some proposals from Box Finding Box downloads spikes is easy, but we want focus on the Proposal Folder We will use the Detect Spikes assistant to help us Use Case
- 41. ▶ | inputlookup anonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time ▶ Looking for “count” by “user” with “6” standard deviations
- 42. ▶ | inputlookup anonymized_box_logs.csv | search folder="PROPOSALS” | bucket _time span=1d | stats count by user _time ▶ Looking for “count” by “user” with “6” standard deviations Got Her!
- 43. Splunk Security Essentials Demo
- 44. Wrap Up
- 45. © 2018 SPLUNK INC. 1. Splunk Security Essentials shows you new detection use cases 2. Ultimately it just uses Splunk Enterprise – power of the platform! 3. You can build your own use cases easily! 4. As you advance, look to ES or UBA to improve threat detection What Did We Cover?
- 46. Splunk Security Portfolio Splunk Enterprise Detection Human-driven • Log Aggregation • Splunk Security Essentials • Rules, statistics, correlation Realm of Known Enterprise Security Response • OOB key security metrics • Incident response workflow • Adaptive response Splunk UBA Detection ML-driven • Risky behavior detection • Entity profiling, scoring • Kill chain, graph analysis Realm of Unknown
- 47. ▶ Download from apps.splunk.com ▶ Find use cases that match your needs ▶ Data Source Check shows other use cases for your existing data ▶ Evaluate free tools to meet gaps, such as Microsoft Sysmon • (links inside the app) Go Get Started With Splunk Security Essentials!
- 48. Thank You! Don't forget to rate this session on Pony Poll